Threat Intelligence Tarot
Vol. II · 90
Russia (FSB Centre 16)
G0108★★★★★
risk 5/5
✦ The Patient Inheritor ✦
Berserk Bear
Energetic Bear · Dragonfly 2.0 · Crouching Yeti · Bromine
Energy sectorICS/SCADA systemsElectric utilitiesNuclear facilitiesGovernmentDefense
Active since ~2010 · Espionage, Pre-positioning in critical infrastructure
The Patient Inheritor does not wish to destroy the machine but to own it, placing invisible hands on the controls of power grids and fuel lines until the day they are needed. Patience measured in years, not months.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆US electric grid intrusions (2017-2018, DHS/FBI alert)
- ◆German energy company targeting
- ◆Nuclear facility network access in the US
- ◆Multi-year persistent access in energy sector OT networks
Defenses
- ▸OT/IT network segmentation with air-gap or strict firewall rulesNIST SP 800-82 ↗
- ▸Multi-factor authentication on all remote access to ICS environmentsNIST CSF: PR.AC ↗
- ▸ICS-specific anomaly detection monitoring for unauthorized command sequencesNIST CSF: DE.CM ↗
- ▸Vendor access management with time-limited, monitored sessionsCIS Control 6 ↗
Reversed: Their Weakness
Air-gapping operational technology networks from IT networks is its primary barrier. ICS-specific intrusion detection systems and strict vendor access controls make persistent pre-positioning significantly harder.
Share this adversary profile
Compare →swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.