Threat Actor Profile

Dragonfly 2.0

Berserk Bear DYMALLOY G0074 IRON LIBERTY

▲ High Threat

Static Tundra / Cisco Edge Exploitation, Polish Energy Infrastructure Attack

Origin Russia

Sponsor Russian Federal Security Service (FSB) - Center 16

Motivation Strategic espionage, intelligence collection, and preparation for disruptive/sabotage operations against critical infrastructure.

Target Sectors

Energy Sector Utilities Critical Infrastructure Telecommunications Manufacturing Nuclear Power Plants Higher Education Oil and Gas

Spearphishing (Malicious Attachments/Links)

Supply Chain Compromise

Exploitation of Edge/Networking Devices (e.g., Cisco Smart Install/SMI)

Living-off-the-Land (LotL)

Credential Harvesting

Exploitation of Legacy Protocols (SNMP, SMI)

Watering Hole Attacks

Custom Malware Deployment (e.g., DYMALLOY, SYNful Knock, Havex)

CISA Advisories ↗

Hacking the mainframe…