Procedure examples

Dragonfly has dropped and executed SecretsDump to dump password hashes.

Dragonfly has dropped and executed SecretsDump to dump password hashes. They also obtained ntds.dit from domain controllers.

Dragonfly has dropped and executed SecretsDump to dump password hashes.

Dragonfly has collected data from local victim systems.

Dragonfly has queried the Registry to identify victim information.

Dragonfly has used batch scripts to enumerate network information, including information about trusts, zones, and the domain.

Dragonfly has likely obtained a list of hosts in the victim environment.

Dragonfly has moved laterally via RDP.

Dragonfly used the command query user on victim hosts.

Dragonfly has created accounts disguised as legitimate backup and service accounts as well as an email administration account.

Dragonfly has used scheduled tasks to automatically log out of created accounts every 8 hours as well as to execute malicious files.

Dragonfly has used the command line for execution.

Dragonfly has used PowerShell scripts for execution.

Dragonfly has used various types of scripting to perform operations, including batch scripts.

Dragonfly has used various types of scripting to perform operations, including Python scripts. The group was observed installing Python 2.7 on a victim.

Dragonfly has used batch scripts to enumerate administrators and users in the domain.

Dragonfly has deleted many of its files used during operations as part of cleanup, including removing applications and deleting screenshots.

Dragonfly has used SMB for C2.

Dragonfly has created a directory named "out" in the user's %AppData% folder and copied files to it.

Dragonfly has compromised user credentials and used valid accounts for operations.

Dragonfly has used a batch script to gather folder and file names from victim hosts.

Dragonfly has used batch scripts to enumerate users on a victim domain controller.

Dragonfly has added newly created accounts to the administrators group to maintain elevated access.

Dragonfly has copied and installed tools for operations once in the victim environment.

Dragonfly has attempted to brute force credentials to gain access.

Dragonfly has dropped and executed tools used for password cracking, including Hydra and CrackMapExec.

Dragonfly has modified the Registry to perform multiple techniques through the use of Reg.

Dragonfly has performed screen captures of victims, including by using a tool, scr.exe (which matched the hash of ScreenUtil).

Dragonfly has accessed email accounts using Outlook Web Access.

Dragonfly has used VPNs and Outlook Web Access (OWA) to maintain access to victim networks.

Dragonfly has identified and browsed file servers in the victim network, sometimes , viewing files pertaining to ICS or Supervisory Control and Data Acquisition (SCADA) systems.

Dragonfly has created accounts on victims, including administrator accounts, some of which appeared to be tailored to each individual staging target.

Dragonfly has gathered hashed user credentials over SMB using spearphishing attachments with external resource links and by modifying .LNK file icon resources to collect credentials from virtualized systems.

Dragonfly has compromised targets via strategic web compromise (SWC) utilizing a custom exploit kit.

Dragonfly has conducted SQL injection attacks, exploited vulnerabilities CVE-2019-19781 and CVE-2020-0688 for Citrix and MS Exchange, and CVE-2018-13379 for Fortinet VPNs.

Dragonfly has placed trojanized installers for control system software on legitimate vendor app stores.

Dragonfly has exploited CVE-2011-0611 in Adobe Flash Player to gain execution on a targeted system.

Dragonfly has used various forms of spearphishing in attempts to get users to open malicious attachments.

Dragonfly has exploited a Windows Netlogon vulnerability (CVE-2020-1472) to obtain access to Windows Active Directory servers.

Dragonfly has injected SMB URLs into malicious Word spearphishing attachments to initiate Forced Authentication.

Dragonfly has commonly created Web shells on victims' publicly accessible email and web servers, which they used to maintain access to a victim network and download additional malicious files.

Dragonfly has added the registry value ntdll to the Registry Run key to establish persistence.

Dragonfly has compressed data into .zip files prior to exfiltration.

Dragonfly has modified the Registry to hide created user accounts.

Dragonfly has sent emails with malicious attachments to gain initial access.

Dragonfly has registered domains for targeting intended victims.

Dragonfly has acquired VPS infrastructure for use in malicious campaigns.

Dragonfly has compromised legitimate websites to host C2 and malware modules.

Dragonfly has obtained and used tools such as Mimikatz, CrackMapExec, and PsExec.

Dragonfly has collected open source information to identify relationships between organizations for targeting purposes.