RussiaAttributedFSB Center 16EspionageActive 2010 – 2025Dragonfly
Also known asEnergetic Bear · Berserk Bear · Crouching Yeti · Ghost Blizzard · BROMINE · DYMALLOY · IRON LIBERTY · TEMP.Isotope · TG-4192 · Static Tundra
Summary
FSB Center 16 (military unit 71330) espionage actor focused on energy and critical-infrastructure networks and on the network devices that carry them — MITRE G0035, also Energetic Bear, Berserk Bear, Crouching Yeti, Microsoft's Ghost Blizzard and Dragos's DYMALLOY. Between 2012 and 2017 three Center 16 officers (Akulov, Gavrilov, Tyukov, charged 2022) ran a two-phase campaign: trojanized ICS/SCADA vendor software updates ('Havex') and then spearphishing and watering holes against energy companies, including the business network of the Wolf Creek nuclear plant. Since at least 2021 the cluster Cisco Talos calls Static Tundra has exploited the 2018 Cisco Smart Install flaw CVE-2018-0171 and SNMP on unpatched and end-of-life routers to steal configurations at scale; in Aug 2025 the FBI reported it had collected configuration files for thousands of US critical-infrastructure devices in the past year, sometimes altering them for access, with interest in ICS protocols. The unit also planted the SYNful Knock Cisco firmware implant (2015). Talos assesses Static Tundra as 'likely a sub-cluster' of Energetic Bear; the FBI attributes the same activity to Center 16 under the Berserk Bear / Dragonfly names.
Attribution
Named by a government: indictment, sanctions designation, joint advisory or official statement.
- FBI (Government, 2025-08-20)
FSB Center 16 unit known as Berserk Bear and Dragonfly - MITRE ATT&CK (MITRE ATT&CK, 2026-10)
Attributed to Russia's FSB Center 16
Campaigns 2
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Static Tundra — Cisco Smart Install CVE-2018-0171 / SNMP configuration theft from network devices | 2021 – 2025 | USA, Global | Telecommunications, Higher Education, Manufacturing, Critical Infrastructure | FBI PSA (2025-08-20); Cisco Talos (2025-08-20) |
| Havex ICS supply chain and energy-sector intrusions incl. Wolf Creek nuclear plant (DOJ 2022 indictment) | 2012 – 2017 | USA, Europe, Global | Energy, Nuclear, Oil & Gas, ICS / SCADA vendors | US DOJ (2022-03-24) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 6
Malware and tools 3
| Name | Description | Platform |
|---|---|---|
| Havex (Backdoor.Oldrea) | RAT delivered via trojanized ICS vendor updates | Windows |
| Trojan.Karagany | Backdoor / downloader | Windows |
| SYNful Knock | Modified Cisco IOS firmware implant | Cisco IOS |
Exploited vulnerabilities 6
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2020-1472 | 10 | Windows Netlogon "ZeroLogon" — privilege escalation (KEV 2021-11-03) |
| CVE-2018-0171 | 9.8 | Cisco IOS / IOS XE Smart Install — remote code execution (KEV 2021-11-03) |
| CVE-2019-19781 | 9.8 | Citrix ADC/Gateway — path traversal RCE (KEV 2021-11-03) |
| CVE-2018-13379 | 9.1 | Fortinet FortiOS SSL VPN — path traversal (KEV 2021-11-03) |
| CVE-2011-0611 | 8.8 | Adobe Flash Player — memory corruption RCE (KEV 2022-03-03) |
| CVE-2020-0688 | 8.8 | Microsoft Exchange Server — fixed cryptographic key RCE (KEV 2021-11-03) |
Highest CVSS first.
Infrastructure patterns
- Trojanized ICS software placed on legitimate vendor download sites (MITRE ATT&CK, 2026)