Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · ENERGETIC BEAR · Nation-state · assessed origin Russia · misp-galaxy + mitre-attack · refreshed 2026-10-06

ENERGETIC BEAR

  • BERSERK BEAR
  • ALLANITE
  • CASTLE
  • DYMALLOY
  • TG-4192
  • Dragonfly
  • Crouching Yeti
  • Group 24

state sponsor · Russian Federationattribution confidence 75/100 (source-stated)MITRE G0035 ↗

ENERGETIC BEAR — ATT&CK roseEB

attack rose · 56 techniques across 12 tactics

Analyst brief

misp-galaxy + mitre-attack

A Russian group that collects intelligence on the energy industry.

Observed targets (as stated by the sources)

10 countries · 3 sectors
United StatesGermanyTürkiyeChinaSpainFranceIrelandJapanItalyPolandAssessed origin: Russia

assessed origin · Russiaobserved targets · 10

countries · 10

  • United States
  • Germany
  • Türkiye
  • China
  • Spain
  • France
  • Ireland
  • Japan
  • Italy
  • Poland

sectors · 3

  • Private sector
  • Government
  • Energy

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

56 techniques · 12 of 15 tactics

  1. Reconnaissance

    4 techniques

  2. Resource development

    5 techniques

  3. Initial access

    4 techniques

  4. Execution

    7 techniques

  5. Persistence

    5 techniques

  6. Stealth

    5 techniques

  7. Defense impairment

    3 techniques

  8. Credential access

    6 techniques

  9. Discovery

    8 techniques

  10. Lateral movement

    2 techniques

  11. Collection

    5 techniques

  12. Command and control

    2 techniques

select a technique

Arsenal

2 malware · 8 tools
Malware
Malware · 2ATT&CK
Backdoor.OldreaS0093 ↗
Trojan.KaraganyS0094 ↗
Tools
Tools · 8ATT&CK
MCMDS0500 ↗
NetS0039 ↗
ImpacketS0357 ↗
CrackMapExecS0488 ↗
RegS0075 ↗
MimikatzS0002 ↗
PsExecS0029 ↗
netshS0108 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs ENERGETIC BEAR is cited as exploiting

none on KEV
  1. CVE-2020-20212026-10-17
    1. “CVE-2020-2021 Palo Alto Networks OS (including GlobalProtect VPN) BERSERK BEAR”

      cited as exploiting · source: go.crowdstrike.com ↗ · 2026-10-17

  2. CVE-2018-133792026-10-17
    1. “CVE-2018-13379 FortiGuard FortiOS SSL VPN BERSERK BEARCOZY BEAR”

      cited as exploiting · named nearby · source: go.crowdstrike.com ↗ · 2026-10-17

  3. CVE-2019-115102026-10-17
    1. “CVE-2019-11510 Pulse Connect Secure (PCS) BERSERK BEAR COZY BEAR VENOMOUS BEAR”

      cited as exploiting · source: go.crowdstrike.com ↗ · 2026-10-17

  4. CVE-2011-06112026-10-17
    1. “The Crouching Yeti threat relayed on three methods to infect the victims, Spear-phishing e-mails using PDF documents embedded with an Adobe Flash exploit (CVE-2011-0611)”

      cited as exploiting · source: kaspersky.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2018Energetic Bear/Crouching Yeti: attacks on serversKaspersky ↗
  2. 2017Dragonfly: Western energy sector targeted by sophisticated attack groupSymantec ↗
  3. 2014Dragonfly: Cyberespionage Attacks Against Energy SuppliersSymantec ↗
  4. 2014Crouching Yeti: AppendixesKaspersky ↗
  5. 2014Energetic Bear _ Crouching YetiKaspersky ↗
  6. 2014Full Disclosure Of Havex TrojansNetresec ↗

Take it with you

keyless · no signup

References

25 sources
  1. 1.gov.uk/government/publications/russias-fsb-malign-cyber-activ…
  2. 2.web.archive.org/web/20161020180305/http://www.scmagazineuk.com/iran-an…
  3. 3.paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2014/Dragonfly_T…
  4. 4.netresec.com/?page=Blog&month=2014-10&post=Full-Disclosure-of-Havex…
  5. 5.threatpost.com/energy-watering-hole-attack-used-lightsout-exploit-kit…
  6. 6.cfr.org/interactive/cyber-operations/crouching-yeti
  7. 7.reuters.com/article/us-ukraine-cyber-attack-energy-idUSKBN1521BA
  8. 8.dragos.com/wp-content/uploads/CrashOverride-01.pdf
  9. 9.independent.ie/irish-news/statesponsored-hackers-targeted-eirgrid-ele…
  10. 10.riskiq.com/blog/labs/energetic-bear
  11. +15 more in the JSON record

Track ENERGETIC BEAR on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.