Dragonfly 2.0 attacks

Dragonfly 2.0 (also Berserk Bear / Energetic Bear) was a multi-year campaign documented by Symantec in 2017 and CISA in 2018 targeting US and European energy-sector organisations. Attackers obtained remote access to operator workstations and HMIs at multiple utilities, in several cases capturing screenshots of running ICS interfaces. The activity was attributed to Russian state-sponsored actors.

No grid-disruption events were attributed to Dragonfly 2.0. CISA assessed the actors achieved 'hands-on access' to control systems at undisclosed energy companies, treating the campaign as pre-positioning.