ENERGETIC BEAR
threat actorRU01
also known as
Other names and identifiers for this entity.
ATT&CK
BROMINE · Berserk Bear · Crouching Yeti · DYMALLOY · Dragonfly · Energetic Bear · Ghost Blizzard · IRON LIBERTY · TEMP.Isotope · TG-4192
MISP
ALLANITE · ATK6 · BERSERK BEAR · BROMINE · Blue Kraken · CASTLE · Crouching Yeti · DYMALLOY · Dragonfly · ENERGETIC BEAR · Ghost Blizzard · Group 24 · Havex · IRON LIBERTY · ITG15 · Koala Team · TG-4192
A Russian group that collects intelligence on the energy industry.
02
resolved ATT&CK groups
Threat groups associated with this.
03
techniques used (58)
ATT&CK techniques this enables or maps to.
showing 20 of 58
04
software used (10)
Malware and tools associated with this.
05
references
External citations — patches, advisories, analysis.
- https://www.gov.uk/government/publications/russias-fsb-malign-cyber-activity-factsheet/russias-fsb-malign-activity-factsheet
- https://web.archive.org/web/20161020180305/http://www.scmagazineuk.com/iran-and-russia-blamed-for-state-sponsored-espionage/article/330401/
- https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2014/Dragonfly_Threat_Against_Western_Energy_Suppliers.pdf
- http://www.netresec.com/?page=Blog&month=2014-10&post=Full-Disclosure-of-Havex-Trojans
- https://threatpost.com/energy-watering-hole-attack-used-lightsout-exploit-kit/104772/
- https://www.cfr.org/interactive/cyber-operations/crouching-yeti
- https://www.reuters.com/article/us-ukraine-cyber-attack-energy-idUSKBN1521BA
- https://dragos.com/wp-content/uploads/CrashOverride-01.pdf