APT Group: Dragonfly / Energetic Bear / Crouching Yeti

Status:

ONGOING

Current US-CERT Alert: TA18-074A
Attack Vectors: Spear-phishing emails, watering hole domains, and Trojans (including but not limited to: TCP exploitation, insecure credential hacking (non-2FA), web shell, and remote access).
Targets: infrastructure of ICS and SCADA - In other words: Intelligence gathering and sabotage.
Mitigation Techniques: Follow on US-CERT Alert bulletin linked above.
First noticed: At least December 2015 for current campaign; 2011-2014 for previous campaign
Last Update: March 2018
Other Notes: Source of attacks linked to the Kremlin APT.
Resources: US-CERT Bulletin TA18-074A - Symantec Analysis