ENERGETIC_BEAR__2020__Resurgent_Iron_Liberty_Targeting_Energy_Sector.pdf

Resurgent IRON LIBERTY (aka Dragonfly/Energetic Bear) is presented as a likely Russian government–linked APT targeting the energy sector and ICS from 2010–2018; the report documents the CASTLE campaign and describes techniques including spearphishing, strategic web compromises, SMB template-injection credential harvesting, use of trojanized installers, and deployment of custom malware (Karagany, MCMD/Havex) to conduct espionage and pre-position for potential sabotage.