Cataloged
IdentityAlias: TEMP.Isotope
Reviewed identity mapping approved on this date.
Dragonfly
Also known as TEMP.Isotope, DYMALLOY, Berserk Bear, TG-4192, Crouching Yeti, IRON LIBERTY, Energetic Bear, Ghost Blizzard, BROMINE
Tracked as
G0035
Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16. Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.
Activity timeline
A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.
Cataloged
IdentityAlias: DYMALLOY
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Berserk Bear
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: TG-4192
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Crouching Yeti
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: IRON LIBERTY
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Energetic Bear
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Ghost Blizzard
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: BROMINE
Reviewed identity mapping approved on this date.
Cataloged
IdentityTracking identifier: G0035
Reviewed identity mapping approved on this date.
Identity and attribution
Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.
Name map
DragonflyCanonical Name
BROMINEAlias
Berserk BearAlias
Crouching YetiAlias
DYMALLOYAlias
Energetic BearAlias
Ghost BlizzardAlias
IRON LIBERTYAlias
TEMP.IsotopeAlias
TG-4192Alias
G0035Tracking Id
Loading CVEs, techniques, indicators, malware, victims, and activity...