Energetic Bear
Attribution profile
- Type
- Nation State
- Location
- Russia
- Known incidents
- 6 incidents
- Sources
- 63 sources
- First seen
- 2018-07-23
- Last seen
- 2025-12-29
- Updated
- 2026-10-03 06:52
- Aliases
- 4 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
DragonFly, also tracked as Energetic Bear, Static Tundra and Berserk Bear, is a Russia‑state‑sponsored threat group. It has historically targeted energy sector organizations and, more recently, expanded to the aviation sector, with observed activity in the United States. The group’s strategic objective is credential harvesting to enable lateral movement, reconnaissance or potential sabotage, as demonstrated by its compromise of San Francisco International Airport employee and contractor websites where it planted code that exploited an Internet Explorer vulnerability to steal Windows login credentials via NTLM hashes. Its typical initial access involves watering‑hole attacks that abuse SMB features and the file:// prefix to capture NTLM hashes, a technique also noted in earlier watering‑hole campaigns. Public attribution links the group to Russian state sponsorship, with ESET and Kaspersky identifying Energetic Bear (DragonFly) behind the airport intrusion. A representative campaign is the compromise of SFOConnect.com and SFOConstruction.com in March 2020, which prompted password resets and credential‑theft mitigations.
Incidents
Attributed incidents are available to members.
6 incidentsSources
Sources available to members: 63 sources.