Threats · Activity group

DYMALLOY

activeOT-focused accessDragosAttribution · Moderate

Last verified2026-08-20

Executive summary

DYMALLOY is reported for deep and long-lived access into electric utilities, oil and gas, and advanced industrial organisations, including access to operator interfaces. Public reporting describes overlap with the widely reported Dragonfly / Energetic Bear activity.

At a glance

Tracked byDragos

NexusAssociated reporting describes Russian state-sponsored activity

First observed2016 (public reporting)

Last reportedContinued Dragos tracking

ICS kill chainStage 1 — Intrusion · Stage 1 — Collection of OT information

Rosetta Stone

Names across the industry

Every edge states the kind of relationship the public source supports — an alias is not the same as an overlap.

DYMALLOY

Dragonfly / Berserk Bear / Energetic Bear
Technical overlapModerate
Tracked by Multiple vendors

Relevance

Why OT defenders care

Objectives

Long-term access to energy sector networks
Collection of operational information including HMI imagery

Reported impacts

Access to operator interfaces reported; no confirmed manipulation of the process

Observed behaviours

Supply-chain and watering-hole access
SMB credential capture
Screenshot collection from operator interfaces

Targeting

Sectors, geography and assets

Target industries

Electric powerOil and gasAdvanced manufacturing

Target geography

United StatesEuropeTurkey

Observed assets

HMIEngineering workstationHistorianDomain controller supporting OT

Protocols in scope

SMBRDPHTTP

Capability

Malware and tools

Malware, commercial tooling, open-source utilities and native operating-system tools are kept separate — they demand different detections.

Malware

Credential harvesting and remote access tooling

Commercial tool

Not publicly established

Open-source utility

Not publicly established

Native OS tool

Native Windows administration tooling

ATT&CK

Technique mapping

ATT&CK Enterprise

ATT&CK for ICS

History

Known campaigns and incidents

Reported campaigns

Reported energy-sector intrusion campaigns described in US government advisories on Dragonfly-related activity

Atlas incident case studies

Not publicly established

Defence

Defensive hunting priorities

Start with the hunts below — each one is a complete procedure in the Field Playbook.

Priorities

Block outbound SMB and monitor forced authentication attempts
Harden HMI access and log sessions
Vendor and supply-chain access review

Hunt for this activity

New IT-to-OT communication pathA corporate system has begun communicating with an OT asset over a path that is not in the approved conduit list.
Unexpected engineering workstation peerAn engineering workstation is communicating with a system outside its normal peer set.
Abnormal RDP usageRDP is being used along a path or at a time that does not match administrative practice.
Historian communicating with an unknown internet hostA process historian is exchanging data with an external destination that is not an approved service.

Indicators

Indicator guidance

Indicators expire. Behaviour usually ages better.

This registry deliberately does not republish volatile IP and domain lists. Pull current indicators from the linked authoritative reporting, match them locally against your own telemetry, and invest your standing detections in the behaviours listed above.

Sources

Vendor IntelligenceDragos
Threat groups — OT activity group profiles (opens in a new tab)
ATT&CKMITRE ATT&CK
Groups (opens in a new tab)

Last verified2026-08-20