Quick links
Press Enter to search, Esc to close
Threat group profile
Attributed by the US and UK governments to Russia's FSB Center 16 (Military Unit 71330), this group is tied to supply chain, phishing and website attacks on energy and industrial control system companies, and to the abuse of weak routers.
In short
Attributed by the US and UK governments to Russia's FSB Center 16 (Military Unit 71330), this group is tied to supply chain, phishing and website attacks on energy and industrial control system companies, and to the abuse of weak routers. Its work is espionage and lasting access to networks.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| Dragonfly | MITRE ATT&CK G0035 (group name); US Department of Justice, 24 March 2022; Rewards for Justice; UK factsheet; CISA advisories AA20-296A and AA22-083A; joint advisory of July 2026[1, 2, 3, 4, 6, 8, 10] |
| TEMP.Isotope | MITRE ATT&CK, associated groups[1] |
| DYMALLOY | MITRE ATT&CK, associated groups; UK factsheet[1, 6] |
| Berserk Bear | MITRE ATT&CK; UK release of 24 March 2022; CISA advisories; UK factsheet; joint advisory of July 2026[1, 3, 4, 6, 7, 10] |
| Berzerk Bear | Spelling used by the US Department of Justice, 24 March 2022[2] |
| TG-4192 | MITRE ATT&CK, associated groups; UK factsheet[1, 6] |
| Crouching Yeti | MITRE ATT&CK; US Department of Justice; Rewards for Justice; UK release; CISA advisories; UK factsheet[1, 2, 3, 4, 6, 7, 8] |
| IRON LIBERTY | MITRE ATT&CK, associated groups; UK factsheet[1, 6] |
| Energetic Bear | MITRE ATT&CK; US Department of Justice; Rewards for Justice; UK release; CISA advisories; UK factsheet[1, 2, 3, 4, 6, 7, 8] |
| Ghost Blizzard | MITRE ATT&CK, associated groups; UK NCSC release of 13 July 2026[1, 11] |
| BROMINE | MITRE ATT&CK, associated groups[1] |
| TeamSpy | CISA advisories AA20-296A and AA22-083A[3, 4] |
| Koala | CISA advisories AA20-296A and AA22-083A[3, 4] |
| Havex | Listed as a name for the actor in CISA advisories AA20-296A and AA22-083A. The US Department of Justice uses it for malware and for phase one of the campaign[2, 3, 4] |
| Dragonfly 2.0 | US Department of Justice name for the 2014 to 2017 phase of the energy campaign[2] |
| CASSTLE | UK factsheet, in its list of public names for Center 16[6] |
| Static Tundra | Joint advisory of July 2026 and UK NCSC release, in lists of names used for Center 16 activity. The advisory says the list may not match the agencies' view 1 to 1[10, 11] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
MITRE ATT&CK 31 July 2026
Describes Dragonfly as a cyber espionage group attributed to Russia's FSB Center 16. Page last modified 31 July 2026.[1]
US CISA and FBI 1 December 2020 (last revised)
Advisory AA20-296A: a Russian state-sponsored actor, known in open-source reporting as Berserk Bear, Energetic Bear, TeamSpy, Dragonfly, Havex, Crouching Yeti and Koala, has targeted US state and local government and aviation networks since at least September 2020. The advisory does not name the FSB.[4]
US Department of Justice Returned 26 August 2021, made public 24 March 2022
Indictment in Kansas charges three officers of FSB Center 16 (Military Unit 71330), Akulov, Gavrilov and Tyukov, over energy sector intrusions between 2012 and 2017. The department says they were members of a unit known as Dragonfly, Berzerk Bear, Energetic Bear and Crouching Yeti.[2]
CISA, FBI and Department of Energy 24 March 2022
Advisory AA22-083A names the FSB, also known as Berserk Bear, Energetic Bear, TeamSpy, Dragonfly, Havex, Crouching Yeti and Koala, for an energy sector intrusion campaign from at least 2011 through 2018.[3]
UK Foreign Office and NCSC 24 March 2022
The NCSC assesses it is almost certain that FSB Center 16 is also known as Energetic Bear, Berserk Bear and Crouching Yeti, and ran a cyber program against critical systems in Europe, the Americas and Asia.[7]
UK Government April 2022 (date per MITRE reference list)
Factsheet names Center 16 (Military Unit 71330) and lists Dragonfly among its public names. It says Center 16 has been observed since at least 2010.[1, 6]
US State Department, Rewards for Justice Page undated
Names Tyukov as a member of a Center 16 operational group, Military Unit 71330, recognized as Dragonfly, Energetic Bear and Crouching Yeti, and offers up to 10 million dollars for information.[8]
FBI August 2025
Public service announcement: cyber actors attributed to FSB Center 16 exploit network devices. It says Berserk Bear and Dragonfly refer to separate but related activity clusters.[9]
NSA, CISA, FBI, NCSC and partner agencies July 2026
Joint advisory says FSB Center 16 cyber actors continue to exploit poorly configured networking devices, and lists Dragonfly among industry names for the activity.[10]
UK NCSC 13 July 2026
Release names Center 16 as also known as Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard and Static Tundra.[11]
Sources differ on whether Dragonfly and Berserk Bear are one group. The US Department of Justice (24 March 2022) and the UK treat the names as one Center 16 unit, while the FBI (August 2025) says they refer to separate but related clusters, and the joint advisory of July 2026 says its list of names may not match the agencies' view 1 to 1. Sources also differ on dates: MITRE and the UK say since at least 2010, the Justice Department dates the Kansas indictment period 2012 to 2017, and CISA advisory AA22-083A says 2011 through 2018.
On the nuclear plant, the UK release says the FBI indicted the group for targeting the systems controlling the plant in 2017, while the Justice Department says the business network was compromised. The UK factsheet also lists Snake, Venomous Bear and Turla among Center 16 names, and the EU names Turla as one of the groups Center 16 controls (statement of 13 July 2026). MITRE does not list those names for Dragonfly, so this page does not treat them as Dragonfly.
Each entry is attributed to the group by the sources cited.
CISA advisory AA22-083A dates the FSB energy sector intrusion campaign from at least 2011 through 2018.[3]
The Justice Department says the conspirators hid Havex malware in legitimate software updates from industrial control system makers, and installed malware on more than 17,000 unique devices.[2]
The UK lists a compromised software package turned into a Trojan at a European maker of programmable logic controllers.[6]
The Justice Department says the conspirators moved to targeted attacks, with phishing of more than 3,300 users at more than 500 companies and entities.[2]
CISA, the FBI and the Department of Energy say the actor first targeted vendors and suppliers, then energy organizations, and took ICS-related data.[3]
The UK lists spear phishing and compromise of networks in the European and North American energy sector.[6]
The UK lists compromise of UK engineering and industrial control companies.[6]
The UK lists sustained scanning and probing of US aviation networks.[6]
CISA and the FBI say data was exfiltrated from at least two victim servers as of 1 October 2020.[4]
The FBI says it detected collection of configuration files for thousands of networking devices.[9]
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| 25 June 2014 | US ICS-CERT (CISA) | ICS alert on HavexFirst alert on malware in vendor software installers. It names no group.[15] |
| 16 March 2018 | US DHS and FBI | Technical alert TA18-074ADescribed a multi-stage campaign by Russian government cyber actors, without naming an FSB unit.[5] |
| 1 December 2020 | US CISA and FBI | Joint advisory AA20-296A (last revised)Described the campaign against state and local government and aviation, with indicators and mitigations.[4] |
| 26 August 2021 | US Department of Justice | Indictment returned in KansasThree Center 16 officers charged with conspiracy to damage an energy facility, computer fraud and wire fraud. Akulov and Gavrilov also face identity theft counts.[2] |
| 24 March 2022 | US Department of Justice | Indictment made publicAnnounced the Kansas charges together with a separate case (Gladkikh) that this page does not attribute to Dragonfly.[2] |
| 24 March 2022 | CISA, FBI, Department of Energy | Joint advisory AA22-083AGave techniques and mitigations for the FSB energy campaign of 2011 to 2018.[3] |
| 24 March 2022 | UK Foreign Office and NCSC | Public attributionExposed Center 16 and assessed it is almost certain it is also known as Energetic Bear, Berserk Bear and Crouching Yeti.[7] |
| 5 April 2022 | UK Government | Factsheet on FSB cyber activityDescribed Center 16, its names and operations. Date as given in MITRE reference list.[1, 6] |
| Undated | US State Department | Rewards for Justice offerUp to 10 million dollars for information on a person acting for a foreign government in cyber activity against US critical infrastructure. Tyukov page.[8] |
| August 2025 | FBI | Public service announcementWarned that FSB Center 16 actors exploit SNMP and Cisco Smart Install flaw CVE-2018-0171.[9] |
| 13 July 2026 | NSA, CISA, FBI and partners | Joint advisoryGave router defense steps against Center 16 activity. Co-sealed by agencies in several countries.[10, 11] |
| 13 July 2026 | UK Government with EU member states | Attribution of Poland grid attackAttributed the December 2025 attack on Poland's energy grid to FSB Center 16. The release does not name Dragonfly.[11, 12] |
| 13 July 2026 | EU High Representative | Statement exposing the 16th CenterSaid the 16th Center controls cyber threat groups including Turla and carried out sabotage in Poland. It does not name Dragonfly.[13, 14] |
Techniques reported for this group, by MITRE ATT&CK tactic.
Supply Chain Compromise: Compromise Software Supply Chain T1195.002
Placed trojanized installers for control system software on vendor sites, spreading Havex.[1, 2, 3]
Drive-by Compromise T1189
Compromised websites that energy sector engineers visit, to plant credential-stealing scripts.[1, 2]
Phishing: Spearphishing Attachment T1566.001
Sent emails with malicious attachments to staff at energy and government targets.[1, 2]
Exploit Public-Facing Application T1190
Used SQL injection and known flaws in Citrix, Exchange, Fortinet VPN and Cisco Smart Install.[1, 4, 9]
Valid Accounts T1078
Used stolen user and administrator credentials to log in and move around.[1, 4]
Backdoor.Oldrea (Havex) Malware
MITRE says it was used by Dragonfly against energy companies since at least 2013. CISA describes Havex as a remote access Trojan that gathers data on control system devices.[3, 16]
Trojan.Karagany Malware
MITRE describes a modular remote access tool used for recon and linked to Dragonfly.[17]
MCMD Tool
MITRE describes a remote access tool that gives a remote command shell.[18]
CrackMapExec Tool
MITRE lists it among tools obtained and used. It is a post-exploitation tool that collects Active Directory information.[1, 19]
Mimikatz Tool
MITRE lists it among tools obtained and used. It is a credential dumper.[1, 20]
PsExec Tool
MITRE lists it among tools obtained and used.[1]
SYNful Knock Malware
The FBI says the unit deployed custom tools to certain Cisco devices, such as the malware publicly identified as SYNful Knock in 2015.[9]
Disable NTLM or restrict outgoing NTLM, and block SMB ports 139 and 445 at the network edge.
Counters T1187
See which routers, VPNs, mail servers and management pages face the internet, the exposures that the 2026 advisory asks defenders to find and secure.
Follow what governments and MITRE report about this group and compare its listed techniques with your own controls.
Find look-alike domains and fake sign-in pages aimed at your staff, since CISA describes malicious domains used against targets and the Justice Department describes phishing.
Watch for leaked or sold company credentials, since MITRE lists use of stolen credentials and valid accounts.
MITRE describes it as a cyber espionage group attributed to Russia's FSB Center 16. The US Department of Justice charged three Center 16 officers in an indictment of 26 August 2021, made public on 24 March 2022, and said they belonged to a unit known as Dragonfly, Berzerk Bear, Energetic Bear and Crouching Yeti.
Sources differ. The Justice Department and the UK name them as parts of one Center 16 unit. In August 2025 the FBI said Berserk Bear and Dragonfly refer to separate but related activity clusters, and the July 2026 joint advisory says its list of names may not match 1 to 1.
It says that between 2012 and 2017 the charged officers ran supply chain attacks and targeted phishing against the energy sector, aimed at industrial control systems, and that malware was installed on more than 17,000 unique devices.
MITRE updated its page on 31 July 2026. The FBI (August 2025) and a joint advisory (July 2026) say Center 16 actors exploit weak or unpatched network devices, and the advisory says they continue to do so.
The UK, with EU member states, attributed the December 2025 attack on Poland's energy grid to FSB Center 16 on 13 July 2026. The sources opened do not say Dragonfly did it by name.
Close router and switch management pages to the internet, turn off Cisco Smart Install, move to SNMPv3, and patch internet-facing systems, as the July 2026 advisory and CISA advise.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.