What tactics and techniques does Energetic Bear (Dragonfly) use?

What Energetic Bear does in practice

Energetic Bear, also known as Dragonfly, is not mainly a noisy smash-and-grab actor. Its tradecraft is built around getting a foothold through people, web paths, and existing access, then using that foothold to move deeper into targeted networks. That makes its tactics important not just as a list of techniques, but as a sequence that supports espionage and long-term presence.

The group’s approach typically starts with threat actor group intelligence that helps defenders recognise a recurring pattern: a named intrusion cluster may use different infrastructure over time, but its operational style remains consistent enough to spot. In this case, the pattern includes phishing, compromised websites, credential theft, and abuse of remote access to gain an initial position inside an environment.

Once inside, the group’s techniques are designed to blend into ordinary business activity. Reconnaissance helps identify valuable systems and operational relationships, while persistence lets the operator keep access after the first intrusion. Movement across industrial and corporate networks is usually more effective when the actor can reuse trusted pathways, stolen credentials, or weakly monitored remote administration channels.

How its tactics map to attacker tradecraft

Phishing gives the actor a way to target users directly and harvest credentials or session access without needing a technical exploit on day one. Compromised websites are useful because they can deliver malicious content through a site that may look legitimate to users or filters. Credential theft then turns a single successful lure or compromise into broader access, especially when reused passwords or poorly protected remote access are present.

Abuse of remote access is especially important because it can make malicious activity look like legitimate administration. If the access path is already trusted by the organisation, defenders may see normal protocol use while the operator is actually expanding access, testing privileges, or pivoting to more sensitive systems. That is why unusual login geography, odd timing, and access to systems outside a user’s normal role are all worth investigating.

The associated reconnaissance and movement phases matter because they show intent beyond simple intrusion. Energetic Bear’s activity is best understood as an intrusion lifecycle, entry, discovery, persistence, and lateral movement, rather than a single exploit. That lifecycle is what makes the actor dangerous to industrial and corporate environments alike.

What defenders should look for first

Defenders should focus on the paths most consistent with this style of intrusion: suspicious emails or web redirects, unexpected credential use, remote access from unusual sources, and logins that do not fit normal user or administrator behaviour. If an account that should only touch business applications is reaching operational systems, that is a strong signal to investigate the access path and the privilege chain behind it.

It is also worth correlating web security logs, identity events, and remote access telemetry. A phishing event by itself is concerning, but the operationally important question is whether it was followed by successful authentication, privilege use, or lateral movement. In espionage-style activity, the quiet follow-on actions often matter more than the initial lure.

Risk and Threat Considerations

This tradecraft is high risk because it depends on trusted access paths rather than obviously malicious malware alone. Once an attacker has valid credentials or a trusted remote channel, the intrusion can look operationally routine while still supporting discovery, persistence, and deeper compromise.

Failure mechanism: The intrusion succeeds when phishing, compromised web content, or credential theft yields legitimate access that defenders treat as normal activity, allowing the actor to blend into routine logins and remote administration.

Impact: The result can be prolonged espionage, broader network reach, and access to industrial or corporate systems that were never intended to be reachable from the original entry point.

Practitioner Guidance

What to verify: Check whether remote access accounts, VPN sessions, and privileged logins are consistent with approved users, approved endpoints, and expected geographies. If the same account is suddenly reaching operational assets or authenticating at odd hours, treat that as a possible intrusion path rather than a benign anomaly.

Decision rule: If a compromise is suspected, prioritise identity and session review before containment assumptions. The critical question is not just whether malware is present, but whether the actor still has valid access that can be reused to pivot, re-enter, or persist.

Practitioner takeaway: For an espionage actor like Energetic Bear, the main defensive task is to break the trust chain, not just remove the initial lure. If access still looks legitimate, the intrusion may still be active.

Related resources from NHI Mgmt Group

• What tactics and techniques does Dragonfly use?
• What tactics and techniques does Saint Bear use?
• What tactics and techniques does Ember Bear use?
• What tactics and techniques does Fancy Bear use?