VERY IMPORTANT

Since at least 2010, the IRON LIBERTY threat group (also known as TG-4192, Energetic Bear, Dragonfly, and Crouching Yeti) has targeted the energy sector with a particular focus on industrial control systems (ICS). Following public disclosures in 2014, the likely Russian government group became less visibly active, but by 2016 it resumed operations with a combination of new and old techniques and tools. Secureworks® Counter Threat Unit™ (CTU) researchers' in-depth analysis of the group's capabilities and targeting revealed an evolving threat to the energy sector and ICS systems, and to the defense and nuclear industries.