Crouching Yeti

Crouching Yeti, also known as Iron Liberty, TG-4192, Energetic Bear, and Dragonfly, is a threat actor group that has been active since at least 2010. This group primarily targets the energy sector, with a specific focus on industrial control systems (ICS). Crouching Yeti's activities are part of a broader pattern of cyber threats posed by state-sponsored actors, particularly those affiliated with Russia. From September 2020 onwards, Crouching Yeti, also identified as Berserk Bear, TeamSpy, Havex, and Koala in various reports, launched a wide-ranging campaign against numerous U.S. targets. These actions exemplify the persistent and sophisticated nature of state-sponsored cyber threats, which often aim to compromise critical infrastructure and disrupt essential services. The group’s activities were further highlighted when FSB hackers Pavel Aleksandrovich Akulov, Mikhail Mikhailovich Gavrilov, and Marat Valeryevich Tyukov, all members of an operational unit dubbed "Dragonfly," "Berzerk Bear," "Energetic Bear," and "Crouching Yeti," were indicted. The indictment alleges that between 2012 and 2017, these individuals and their co-conspirators conducted computer intrusions, including supply chain attacks, aiming to maintain unauthorized and persistent access to the computer networks of international energy sector companies. This included oil and gas firms, nuclear power plants, and utility and power transmission companies, underscoring the Russian government's strategic interest in these sectors.