Dragonfly

Dragonfly is a notable threat actor known for its malicious activities in the cybersecurity landscape. This group has been particularly active in targeting the energy sector across various countries, including the United States, Switzerland, and Turkey. The tactics employed by Dragonfly often involve traditional IT attack vectors, affecting both IT and OT environments. Notably, Dragonfly was involved in a series of watering hole attacks in 2017, as reported by Symantec. This same technique was observed again in subsequent instances, highlighting the group's consistent approach to cyber warfare. In July 2023, Trail of Bits conducted a comprehensive review of the Dragonfly codebase. Their findings were published in a report which included a maturity evaluation of the codebase, a list of identified code quality issues, and guidance for running static and dynamic analysis tooling on the Dragonfly codebase. Notably, the MD5 hash of “scr.exe” matched that of ScreenUtil, aligning with details from the Symantec Dragonfly 2.0 report. In at least two instances, the threat actors used batch scripts labeled “pss.bat” and “psc.bat” to run the PsExec tool, revealing their modus operandi. Dragonfly is also linked to a peer-to-peer file distribution and image acceleration system, which is a CNCF-hosted project. It features integrity checking for downloaded files, download speed limiting, the ability to isolate abnormal peers, and a public registry of artifacts aimed at being “the trusted cloud native repository for Kubernetes.” A subproject of Dragonfly, Nydus, implements a content-addressable filesystem to enable high-efficiency distribution for cloud-native resources. However, security companies like Harpie, supported by Coinbase Ventures and Dragonfly Capital, are working diligently to counteract these threats and secure the cyber landscape.