Organisations defend against Energetic Bear (Dragonfly) by hardening remote access, segmenting operational networks, and tightly controlling vendor paths into critical systems. Monitor for credential theft, spearphishing, and unusual engineering workstation activity, then treat exposed internet-facing systems and weak third-party access as high-risk entry points. Test recovery and incident response for OT-specific disruption scenarios.
How to block the most common Dragonfly entry paths
Energetic Bear, also known as Dragonfly, is best defended against by reducing the access paths it tends to exploit first: remote access, third-party connectivity, and exposed systems that sit too close to operational technology. The practical goal is to make initial footholds hard to gain, easy to detect, and difficult to expand from into critical environments.
Harden remote access with phishing-resistant authentication, tightly scoped vendor access, and explicit approval for any path into engineering or control environments. Keep externally reachable services to the minimum needed and place them behind stronger inspection and segmentation. A useful baseline for this kind of control layering is the NIST Cybersecurity Framework 2.0, which aligns well with protecting, detecting and recovering across connected environments.
Third-party access deserves the same scrutiny as internal privileged access. Where suppliers, contractors or integrators need access into OT-adjacent systems, constrain what they can reach, when they can reach it, and from which devices or networks. If the connection path itself cannot be reduced, compensate with stronger monitoring and a very short review cycle for every exception.
Why segmentation and monitoring matter in OT-focused intrusions
The main defensive advantage against this threat is to prevent a workstation, jump host or vendor session from becoming a bridge into broader operational systems. Segmentation limits blast radius, while monitoring helps you spot the behaviours that often precede disruption, such as credential theft, unusual workstation use, or movement toward engineering assets that should not normally be touched.
Look at workstation behaviour as a control point, not just an endpoint issue. Pay attention to privileged logons, new remote tools, unusual administrative activity, and access to systems that configure or supervise industrial operations. Micro-segmentation and explicit trust boundaries are especially important here, and the Zero Trust model is a strong fit for that design pattern, which is why many teams map this problem to NIST SP 800-207 Zero Trust Architecture.
OT disruption is rarely a single-event problem. If an attacker gets one foothold, the next risk is lateral movement into systems that can affect availability, safety, or process integrity. That is why vendor paths, engineering workstations, and remotely administered systems should be reviewed together rather than as separate control domains.
Recovery preparation is part of the defence
For this threat, defence is not complete until recovery has been rehearsed for industrial disruption, not just office IT outage. Teams need to know how to isolate compromised access paths, preserve evidence, restore core monitoring, and bring critical services back without assuming the environment can simply be rebuilt from standard enterprise playbooks.
That means testing incident response against scenarios where remote access is abused, credentials are stolen, or an engineering workstation is suspected of tampering. Recovery plans should include clear decision points for disconnecting vendor access, revoking sessions, and validating that affected control and supervision systems are trustworthy before they are reintroduced. When identity and access controls are part of the attack path, a practical reference point is NIST SP 800-53 Rev 5 Security and Privacy Controls, which gives a mature structure for access, audit and configuration controls.
Risk and Threat Considerations
Dragonfly is dangerous because it targets the boundary between business IT and operational systems. Once remote access, supplier trust or engineering workstations are abused, the attacker can move toward disruption, not just data loss. That raises the risk of prolonged outage, loss of process visibility, and difficult-to-contain lateral spread.
Failure mechanism: The intrusion path often starts with stolen credentials, phishing, or weak third-party access, then expands through under-segmented networks and overtrusted engineering access into systems that can affect OT operations.
Impact: The likely consequence is loss of availability or control in critical environments, along with delayed recovery because the initial access path, endpoint trust and vendor relationships all need to be revalidated.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207), NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Authenticator Management | Remote access hardening depends on strong, managed authentication for privileged entry paths. |
| Recommendation — Require strong authenticator management for all remote and vendor access paths. | ||
| NIST Zero Trust (SP 800-207) | 3.0 — Zero Trust Architecture | Segmentation and explicit trust boundaries are central to constraining lateral movement into OT. |
| Recommendation — Apply zero trust principles to segment OT-adjacent access and verify every session. | ||
| NIST SP 800-53 Rev 5 | AC-17 — Remote Access | The question centers on controlling remote access into critical systems and vendor paths. |
| Recommendation — Restrict and monitor remote access pathways into operational environments. | ||
| MITRE ATT&CK | T1110 — Brute Force | Credential theft and access abuse are key intrusion mechanisms to detect and block. |
| Recommendation — Hunt for credential abuse patterns and harden authentication against access attacks. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | Network segmentation and boundary control are core to limiting spread into critical systems. |
| Recommendation — Segment networks and manage trust boundaries to limit attacker movement. | ||
Practitioner Guidance
What to prioritise: Start with the connections that can reach critical systems, not with every endpoint equally. If a vendor path or remote admin route can reach engineering assets, treat that path as a control owner problem, not just a network problem.
What to verify: Confirm that remote access is tied to strong authentication, that vendor sessions are time-bound and auditable, and that engineering workstations are monitored for unusual tool use or privilege changes. If you cannot explain why a path exists, it probably deserves tighter restriction.
What practitioners underestimate: Recovery readiness matters as much as prevention in OT-adjacent incidents. The key question is not only whether an attacker can get in, but whether your team can safely identify, isolate and restore the affected environment without relying on the same trust relationships that were abused.
Practitioner takeaway: The most effective defence is to reduce trust in remote and vendor access paths before the attacker reaches operational systems, then rehearse recovery as if those paths are already compromised.