Security Resilience

Threat actor · all actors

DragonflyG0035 state

🇷🇺 RU · FSB

aka Dragonfly, TEMP.Isotope, DYMALLOY, Berserk Bear, TG-4192, Crouching Yeti, IRON LIBERTY, Energetic Bear, Ghost Blizzard, BROMINE, ALLANITE, CASTLE, Group 24, Havex, Koala Team, G0035, ATK6, ITG15, Blue Kraken, Palmetto Fusion

Last updated: 2026-10-16

20attributed CVEs
82ATT&CK techniques
46.5IDF score (tooling uniqueness)
0exclusive CVEs
2008–2026years active

About this actor

Adversaries abusing ICS (based on Dragos Inc adversary list). ALLANITE accesses business and industrial control (ICS) networks, conducts reconnaissance, and gathers intelligence in United States and United Kingdom electric utility sectors. Dragos assesses with moderate confidence that ALLANITE operators continue to maintain ICS network access to: (1) understand the operational environment necessary to develop disruptive capabilities, (2) have ready access from which to disrupt electric utilities. ALLANITE uses email phishing campaigns and compromised websites called watering holes to steal credentials and gain access to target networks, including collecting and distributing screenshots of industrial control systems. ALLANITE operations limit themselves to information gathering and have not demonstrated any disruptive or damaging capabilities. ALLANITE conducts malware-less operations primarily leveraging legitimate and available tools in the Windows operating system.

Source: MITRE ATT&CK

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

MITRE ATT&CKG-number catalogue id

G0035

Microsoftweather-system names

Ghost Blizzard

CrowdStrikenation-animal names

Berserk BearEnergetic Bear

MandiantTEMP temporary cluster

TEMP.Isotope

Secureworkscolour-metal names

IRON LIBERTY

DragosICS mineral names

DYMALLOYALLANITE

Unclassifiedno scheme matched

DragonflyTG-4192Crouching YetiBROMINECASTLEGroup 24HavexKoala TeamATK6ITG15Blue KrakenPalmetto Fusion

How we know this

Data origin
MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
Techniques
MITRE ATT&CK STIX mappings — 82 ATT&CK techniques on file.
Named victims
None on file.

See how actor data is built for the full pipeline.

Activity timeline

2008: 1 CVE published120082018: 1 CVE published120182019: 8 CVE published820192020: 5 CVE published520202021: 4 CVE published2021: 14 KEV added1820212022: 4 KEV added420222026: 1 KEV added12026
CVE publishedKEV added

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2019-11510 KEV10.010.01.00002019-05-08see CVE
CVE-2019-7609 KEV10.010.00.97342019-03-25see CVE
CVE-2018-0171 KEV9.99.80.99512018-03-28see CVE
CVE-2019-10149 KEV9.99.80.99962019-06-05see CVE
CVE-2019-19781 KEV9.99.81.00002019-12-27see CVE
CVE-2019-2725 KEV9.99.80.99982019-04-26see CVE
CVE-2019-9670 KEV9.99.80.99992019-05-29see CVE
CVE-2020-14882 KEV9.99.81.00002020-10-21see CVE
CVE-2020-5902 KEV9.99.81.00002020-07-01see CVE
CVE-2018-13379 KEV9.59.11.00002019-06-04see CVE
CVE-2021-26855 KEV9.59.11.00002021-03-03see CVE
CVE-2020-0688 KEV9.28.80.99972020-02-11see CVE
CVE-2020-4006 KEV9.09.10.55212020-11-23see CVE
CVE-2008-4128 KEV8.78.10.33922008-09-18see CVE
CVE-2019-1653 KEV8.57.50.99882019-01-24see CVE
CVE-2021-26857 KEV8.57.80.95762021-03-03see CVE
CVE-2021-26858 KEV8.57.80.93652021-03-03see CVE
CVE-2021-27065 KEV8.57.80.99952021-03-03see CVE
CVE-2020-1472 KEV7.55.50.99512020-08-17see CVE
CVE-2008-412813 0.00.00.0000see CVE

Mitigating controls (NIST 800-53)

ControlTechniques coveredCoverage
SI-453 / 8265%
CM-650 / 8261%
CM-240 / 8249%
AC-335 / 8243%
AC-634 / 8241%
AC-232 / 8239%
CA-731 / 8238%
CM-731 / 8238%
SI-331 / 8238%
IA-226 / 8232%
SI-726 / 8232%
AC-525 / 8230%
AC-423 / 8228%
SC-723 / 8228%
CM-522 / 8227%

Co-occurring actors

Similar actors

Similar TTPs

Overlapping CVEs

Active in same years

Same nation-state

Same category