{"id":83197,"date":"2017-12-17T21:03:12","date_gmt":"2017-12-18T05:03:12","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=83197"},"modified":"2025-06-03T21:20:52","modified_gmt":"2025-06-04T04:20:52","slug":"operation-dragonfly-analysis-suggests-links-to-earlier-attacks","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/operation-dragonfly-analysis-suggests-links-to-earlier-attacks\/","title":{"rendered":"Operation Dragonfly Analysis Suggests Links to Earlier Attacks"},"content":{"rendered":"

On September 6, Symantec published details of the Dragonfly campaign, which targeted dozens of energy companies throughout 2017. This attack was effectively Dragonfly 2.0, an update to a campaign that began in 2014.<\/p>\n

Moving beyond our 2014 analysis of Dragonfly,<\/a> our current focus looks at the attack\u2019s indicators to determine whether we can glean any further information regarding the source and possible motivations of those behind the campaign. The campaign targets energy companies around the world by leveraging spear-phishing emails that, once successful, allow the attackers to download Trojan software. The Trojans provide access to the victims\u2019 systems and networks.<\/p>\n

Going Beyond Energy<\/strong><\/h2>\n

Although initial reports showed Dragonfly attacks targeting the energy sector, investigations by McAfee Labs and the Advanced Threat Research team uncovered related attacks targeting the pharmaceutical, financial, and accounting industries. Everything about this campaign points to a well-prepared assault that carefully considers each target, and conducts reconnaissance before taking any measures to exploit compromised targets.<\/p>\n

We saw the group use several techniques to get a foothold in victims\u2019 networks, including spear phishing, watering holes, and exploits of supply-chain technologies via previous campaigns. By compromising well-established software vulnerabilities and embedding within them \u201cbackdoor\u201d malware, the victims think they are installing software from a trusted vendor, while unaware of the supply-side compromise.<\/p>\n

Once the attackers have a foothold, they create or gain user accounts to operate stealthily. Using the remote-desktop protocol to hop among internal or external systems, they connect either to a control server if the risk is minimal or use an internal compromised server to conduct operations.<\/p>\n

The last wave of attacks used several backdoors and utilities. In analyzing the samples, we compared these with McAfee\u2019s threat intelligence knowledge base of attack artifacts.<\/p>\n

One of the starting points was a Trojan in the 2017 campaign with the following hashes:<\/p>\n