Energetic Bear

Energetic Bear, also known as DragonFly, Crouching Yeti, and Berserk Bear, is a threat actor that has been operational since at least 2011. The group has been linked to various cyber-espionage campaigns targeting the energy sector in Europe and North America, with the primary focus on defense and aviation companies in the US and Canada. Their preferred malware tool is Backdoor.Oldrea, also known as Havex or the Energetic Bear Remote Access Trojan (RAT). Karagany, another modular RAT, is also associated with this threat group. The group is tied to Center 16, an operational unit of FSB hackers including Pavel Aleksandrovich Akulov, Mikhail Mikhailovich Gavrilov, and Marat Valeryevich Tyukov. Between 2012 and 2017, these individuals, along with their co-conspirators, engaged in computer intrusions, including supply chain attacks, to maintain unauthorized and persistent access to the computer networks of international energy sector companies. These activities were conducted in furtherance of the Russian government's efforts to infiltrate oil and gas firms, nuclear power plants, and utility and power transmission companies. To prevent becoming victims of such attacks, companies are advised to implement safeguards against domain impersonation, install robust email security protocols like DMARC, SPF, and DKIM, enable Enhanced Safe Browsing for Chrome, ensure all devices are updated, and vet any previously unknown entity claiming to be a colleague or field expert. Despite some disputes over attribution, there is consensus that Energetic Bear represents a significant threat to global critical infrastructure, with links to other notorious cyber espionage activities such as Turla and Gamaredon.