Gigamon Berserk Bear October 2021

Backdoor.Oldrea collects information about the Internet adapter configuration.

Backdoor.Oldrea can enumerate and map ICS-specific systems in victim environments.

Backdoor.Oldrea can use a network scanning module to identify ICS-related ports.

Backdoor.Oldrea injects itself into explorer.exe.

Dragonfly has compromised user credentials and used valid accounts for operations.

Backdoor.Oldrea collects information about the OS and computer name.

Dragonfly has used a batch script to gather folder and file names from victim hosts.

Backdoor.Oldrea can download additional modules from C2.

Dragonfly has performed screen captures of victims, including by using a tool, scr.exe (which matched the hash of ScreenUtil).

Dragonfly has gathered hashed user credentials over SMB using spearphishing attachments with external resource links and by modifying .LNK file icon resources to collect credentials from virtualized systems.

Dragonfly has compromised targets via strategic web compromise (SWC) utilizing a custom exploit kit.

Dragonfly has placed trojanized installers for control system software on legitimate vendor app stores.

Dragonfly has exploited CVE-2011-0611 in Adobe Flash Player to gain execution on a targeted system.

Dragonfly has used various forms of spearphishing in attempts to get users to open malicious attachments.

Backdoor.Oldrea can use rundll32 for execution on compromised hosts.

Backdoor.Oldrea adds Registry Run keys to achieve persistence.

Dragonfly has sent emails with malicious attachments to gain initial access.

Dragonfly has acquired VPS infrastructure for use in malicious campaigns.

Dragonfly has compromised legitimate websites to host C2 and malware modules.

Dragonfly has collected open source information to identify relationships between organizations for targeting purposes.

Dragonfly has compromised websites to redirect traffic and to host exploit kits.