Threat Actors Ember Bear

Ember Bear

G1003 TLP:CLEAR

Active

Kill Chain Analysis Generate Graph Hunt Package

Also known as: UNC2589, Bleeding Bear, DEV-0586, Cadet Blizzard, Frozenvista, UAC-0056, TA471, Nascent Ursa, Nodaria, Storm-0587, DEV-0587, Saint Bear, Lorec53, EMBER BEAR, Lorec Bear, Ruinous Ursa

Description

Ember Bear is a Russian state-sponsored cyber espionage group that has been active since at least 2020, linked to Russia's General Staff Main Intelligence Directorate (GRU) 161st Specialist Training Center (Unit 29155).(Citation: CISA GRU29155 2024) Ember Bear has primarily focused operations against Ukrainian government and telecommunication entities, but has also operated against critical infrastructure entities in Europe and the Americas.(Citation: Cadet Blizzard emerges as novel threat actor) Ember Bear conducted the WhisperGate destructive wiper attacks against Ukraine in early 2022.(Citation: CrowdStrike Ember Bear Profile March 2022)(Citation: Mandiant UNC2589 March 2022)(Citation: CISA GRU29155 2024) There is some confusion as to whether Ember Bear overlaps with another Russian-linked entity referred to as Saint Bear. At present available evidence strongly suggests these are distinct activities with different behavioral profiles.(Citation: Cadet Blizzard emerges as novel threat actor)(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )

AI Analysis

· 1 week ago

Executive Summary

Ember Bear, also known as UNC2589, Bleeding Bear, and several other aliases, is a Russian state-sponsored cyber espionage group associated with the GRU's Unit 29155. The group has been active since at least 2020 and has primarily targeted Ukrainian government and telecommunication entities, though it has also attacked critical infrastructure in Europe and the Americas. Known for its use of destructive malware, such as WhisperGate, Ember Bear operates with a mix of advanced persistent threat (APT) tactics and destructive wiper attacks.

Goals & Targeting

Ember Bear's primary strategic objective appears to be conducting cyber espionage and disruptive attacks against Ukrainian government entities, telecommunication networks, and critical infrastructure. The group likely operates under the broader strategic goals of supporting Russian geopolitical interests, particularly in destabilizing Ukraine and other regions where Russia has competing interests. Its targeting of critical infrastructure suggests a focus on disrupting national security and economic stability, while its operations against telecommunications may aim to compromise sensitive communications or gain access to valuable data. Typical victims include government agencies, utility companies, and other key sectors.

Enhanced Description

Ember Bear is a Russian state-sponsored cyber espionage group linked to the Main Intelligence Directorate (GRU) General Staff's 161st Specialist Training Center (Unit 29155). The group has been active since at least 2020 and has primarily targeted Ukrainian government and telecommunication entities. In addition to its focus on Ukraine, Ember Bear has conducted operations against critical infrastructure in Europe and the Americas. Notably, the group is known for its use of destructive malware, such as WhisperGate, which was deployed in early 2022. While there is some confusion about whether Ember Bear overlaps with another Russian-linked entity called Saint Bear, available evidence suggests these are distinct groups with different behavioral profiles. Ember Bear has demonstrated a range of capabilities, including cyber espionage and supply chain compromise, and has been observed using custom tools like reGeorg and P.A.S. Webshell, as well as leveraging known techniques such as malicious PowerShell scripts and credential dumping.

Key Capabilities

State-sponsored cyber espionage
Destructive malware deployment (e.g., WhisperGate)
Advanced persistence techniques
Supply chain compromise
Custom tools development (reGeorg, P.A.S. Webshell)
Credential dumping and lateral movement
Network discovery and enumeration

MITRE ATT&CK Tactics

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

ATT&CK Techniques

T1588.005

T1053.005

T1583

T1003

T1491.002

T1133

T1114

T1003.002

T1036.005

T1003.004

T1119

T1036

T1005

T1195

T1190

T1572

T1560

T1021

T1595.002

T1112

T1505.003

T1003.001

T1110.003

T1070.004

T1595.001

T1018

T1046

T1550.002

T1047

T1561.002

Software / Tooling

reGeorg

P.A.S. Webshell

WhisperGate

Saint Bot

Campaigns & Victims

Ember Bear's campaign patterns include targeting critical infrastructure and government entities, often with destructive malware such as WhisperGate. The group has demonstrated a capability for long-term persistence and lateral movement within networks. Notable campaigns include the early 2022 wiper attacks against Ukraine. Victims have included both public sector organizations and private companies in sectors like energy and utilities. Operational tempo suggests a focus on high-impact targets, with an emphasis on disrupting rather than solely stealing data.

IOC Patterns

Spear-phishing emails targeting government or critical infrastructure employees
Use of PowerShell scripts for initial access and lateral movement
Destructive malware deployment (e.g., WhisperGate)
Network scanning and enumeration techniques
Collection of credentials via LSASS memory dumping
Exfiltration of data to external storage services

Recommended Actions

Enhance network monitoring for unusual activities, especially PowerShell execution and scheduled task creation.
Implement strong defensive measures around critical infrastructure, including regular patching and endpoint detection tools.
Monitor for signs of supply chain compromise and third-party vendor access.
Secure credentials with multi-factor authentication and limit access to sensitive systems.
Conduct regular training sessions on identifying spear-phishing attempts.

Suggested Tags

APT

cyber espionage

state-sponsored

Ukraine

critical infrastructure

Confidence Assessment

Confidence in Ember Bear's identity is high, though some confusion exists regarding overlaps with Saint Bear. The group's operational pattern and toolset suggest a high level of sophistication consistent with state sponsorship. Gaps exist in fully understanding the group's exact motivations beyond its apparent focus on Ukraine, though evidence strongly links it to Russian intelligence services.

ATT&CK Techniques

Collection

5 techniques

T1005

Data from Local System

Ember Bear gathers victim system information such as enumerating the volume of a given device or extracting system and security event logs for analysis.(Citation: Cadet Blizzard emerges as novel threat actor)(Citation: CISA GRU29155 2024)

T1114

Email Collection

Ember Bear attempts to collect mail from accessed systems and servers.(Citation: Cadet Blizzard emerges as novel threat actor)(Citation: CISA GRU29155 2024)

T1119

Automated Collection

Ember Bear engages in mass collection from compromised systems during intrusions.(Citation: Cadet Blizzard emerges as novel threat actor)

T1125

Video Capture

Ember Bear has exfiltrated images from compromised IP cameras.(Citation: CISA GRU29155 2024)

T1560

Archive Collected Data

Ember Bear has compressed collected data prior to exfiltration.(Citation: CISA GRU29155 2024)

Command & Control

5 techniques

T1071.004

DNS

Ember Bear has used DNS tunnelling tools, such as dnscat/2 and Iodine, for C2 purposes.(Citation: CISA GRU29155 2024)

T1090.003

Multi-hop Proxy

Ember Bear has configured multi-hop proxies via ProxyChains within victim environments.(Citation: CISA GRU29155 2024)

T1095

Non-Application Layer Protocol

Ember Bear uses socket-based tunneling utilities for command and control purposes such as NetCat and Go Simple Tunnel (GOST). These tunnels are used to push interactive command prompts over the created sockets.(Citation: Cadet Blizzard emerges as novel threat actor) Ember Bear has also used reverse TCP connections from Meterpreter installations to communicate back with C2 infrastructure.(Citation: CISA GRU29155 2024)

T1571

Non-Standard Port

Ember Bear has used various non-standard ports for C2 communication.(Citation: CISA GRU29155 2024)

T1572

Protocol Tunneling

Ember Bear has used ProxyChains to tunnel protocols to internal networks.(Citation: CISA GRU29155 2024)

Credential Access

7 techniques

T1003

OS Credential Dumping

Ember Bear gathers credential material from target systems, such as SSH keys, to facilitate access to victim environments.(Citation: Cadet Blizzard emerges as novel threat actor)

T1003.001

LSASS Memory

Ember Bear uses legitimate Sysinternals tools such as procdump to dump LSASS memory.(Citation: Cadet Blizzard emerges as novel threat actor)(Citation: CISA GRU29155 2024)

T1003.002

Security Account Manager

Ember Bear acquires victim credentials by extracting registry hives such as the Security Account Manager through commands such as <code>reg save</code>.(Citation: Cadet Blizzard emerges as novel threat actor)(Citation: CISA GRU29155 2024)

T1003.004

LSA Secrets

Ember Bear has used frameworks such as Impacket to dump LSA secrets for credential capture.(Citation: CISA GRU29155 2024)

T1110

Brute Force

Ember Bear used the `su-bruteforce` tool to brute force specific users using the `su` command.(Citation: CISA GRU29155 2024)

T1110.003

Password Spraying

Ember Bear has conducted password spraying against Outlook Web Access (OWA) infrastructure to identify valid user names and passwords.(Citation: CISA GRU29155 2024)

T1552.001

Credentials In Files

Ember Bear has dumped configuration settings in accessed IP cameras including plaintext credentials.(Citation: CISA GRU29155 2024)

Defense impairment

1 technique

T1112

Modify Registry

Ember Bear modifies registry values for anti-forensics and defense evasion purposes.(Citation: Cadet Blizzard emerges as novel threat actor)

Discovery

3 techniques

T1018

Remote System Discovery

Ember Bear has used tools such as Nmap and MASSCAN for remote service discovery.(Citation: CISA GRU29155 2024)

T1046

Network Service Discovery

Ember Bear has used tools such as NMAP for remote system discovery and enumeration in victim environments.(Citation: CISA GRU29155 2024)

T1654

Log Enumeration

Ember Bear has enumerated SECURITY and SYSTEM log files during intrusions.(Citation: CISA GRU29155 2024)

Execution

4 techniques

T1047

Windows Management Instrumentation

Ember Bear has used WMI execution with password hashes for command execution and lateral movement.(Citation: CISA GRU29155 2024)

T1053.005

Scheduled Task

Ember Bear uses remotely scheduled tasks to facilitate remote command execution on victim machines.(Citation: Cadet Blizzard emerges as novel threat actor)

T1059.001

PowerShell

Ember Bear has used PowerShell commands to gather information from compromised systems, such as email servers.(Citation: CISA GRU29155 2024)

T1203

Exploitation for Client Execution

Ember Bear has used exploits to enable follow-on execution of frameworks such as Meterpreter.(Citation: CISA GRU29155 2024)

Exfiltration

1 technique

T1567.002

Exfiltration to Cloud Storage

Ember Bear has used tools such as Rclone to exfiltrate information from victim environments to cloud storage such as `mega.nz`.(Citation: CISA GRU29155 2024)

Impact

2 techniques

T1491.002

External Defacement

Ember Bear is linked to the defacement of several Ukrainian organization websites.(Citation: Cadet Blizzard emerges as novel threat actor)

T1561.002

Disk Structure Wipe

Ember Bear conducted destructive operations against victims, including disk structure wiping, via the WhisperGate malware in Ukraine.(Citation: Cadet Blizzard emerges as novel threat actor)

Initial Access

2 techniques

T1190

Exploit Public-Facing Application

Ember Bear gains initial access to victim environments by exploiting external-facing services. Examples include exploitation of CVE-2021-26084 in Confluence servers; CVE-2022-41040, ProxyShell, and other vulnerabilities in Microsoft Exchange; and multiple vulnerabilities in open-source platforms such as content management systems.(Citation: Cadet Blizzard emerges as novel threat actor)(Citation: CISA GRU29155 2024)

T1195

Supply Chain Compromise

Ember Bear has compromised information technology providers and software developers providing services to targets of interest, building initial access to ultimate victims at least in part through compromise of service providers that work with the victim organizations.(Citation: Cadet Blizzard emerges as novel threat actor)

Lateral Movement

4 techniques

T1021

Remote Services

Ember Bear uses valid network credentials gathered through credential harvesting to move laterally within victim networks, often employing the Impacket framework to do so.(Citation: Cadet Blizzard emerges as novel threat actor)

T1210

Exploitation of Remote Services

Ember Bear has used exploits for vulnerabilities such as MS17-010, also known as `Eternal Blue`, during operations.(Citation: CISA GRU29155 2024)

T1550.002

Pass the Hash

Ember Bear has used pass-the-hash techniques for lateral movement in victim environments.(Citation: CISA GRU29155 2024)

T1570

Lateral Tool Transfer

Ember Bear retrieves follow-on payloads direct from adversary-owned infrastructure for deployment on compromised hosts.(Citation: Cadet Blizzard emerges as novel threat actor)

Persistence

2 techniques

T1133

External Remote Services

Ember Bear have used VPNs both for initial access to victim environments and for persistence within them following compromise.(Citation: CISA GRU29155 2024)

T1505.003

Web Shell

Ember Bear deploys web shells following initial access for either follow-on command execution or protocol tunneling. Example web shells used by Ember Bear include P0wnyshell, reGeorg, P.A.S. Webshell, and custom variants of publicly-available web shell examples.(Citation: Cadet Blizzard emerges as novel threat actor)(Citation: CISA GRU29155 2024)

Reconnaissance

2 techniques

T1595.001

Scanning IP Blocks

Ember Bear has targeted IP ranges for vulnerability scanning related to government and critical infrastructure organizations.(Citation: CISA GRU29155 2024)

T1595.002

Vulnerability Scanning

Ember Bear has used publicly available tools such as MASSCAN and Acunetix for vulnerability scanning of public-facing infrastructure.(Citation: CISA GRU29155 2024)

Resource Development

5 techniques

T1583

Acquire Infrastructure

Ember Bear uses services such as IVPN, SurfShark, and Tor to add anonymization to operations.(Citation: Cadet Blizzard emerges as novel threat actor)

T1583.003

Virtual Private Server

Ember Bear has used virtual private servers (VPSs) to host tools, perform reconnaissance, exploit victim infrastructure, and as a destination for data exfiltration.(Citation: CISA GRU29155 2024)

T1585

Establish Accounts

Ember Bear has created accounts on dark web forums to obtain various tools and malware.(Citation: CISA GRU29155 2024)

T1588.001

Malware

Ember Bear has acquired malware and related tools from dark web forums.(Citation: CISA GRU29155 2024)

T1588.005

Exploits

Ember Bear has obtained exploitation scripts against publicly-disclosed vulnerabilities from public repositories.(Citation: CISA GRU29155 2024)

Stealth

4 techniques

T1036

Masquerading

Ember Bear has renamed the legitimate Sysinternals tool procdump to alternative names such as <code>dump64.exe</code> to evade detection.(Citation: Cadet Blizzard emerges as novel threat actor)

T1036.005

Match Legitimate Resource Name or Location

Ember Bear has renamed tools to match legitimate utilities, such as renaming GOST tunneling instances to `java` in victim environments.(Citation: CISA GRU29155 2024)

T1070.004

File Deletion

Ember Bear deletes files related to lateral movement to avoid detection.(Citation: Cadet Blizzard emerges as novel threat actor)

T1078.001

Default Accounts

Ember Bear has abused default user names and passwords in externally-accessible IP cameras for initial access.(Citation: CISA GRU29155 2024)

Software / Tooling

S0598

P.A.S. Webshell

Family

Ember Bear has used P.A.S. Webshell during intrusions.(Citation: CISA GRU29155 2024)

S1018

Saint Bot

Family

Ember Bear has used Saint Bot during operations, but is distinct from the threat actor Saint Bear.(Citation: CISA GRU29155 2024)

S0689

WhisperGate

Family

Ember Bear is associated with WhisperGate use against multiple victims in Ukraine.(Citation: Cadet Blizzard emerges as novel threat actor)(Citation: CrowdStrike Ember Bear Profile March 2022)(Citation: Mandiant UNC2589 March 2022)

S1187

reGeorg

Family

(Citation: Cadet Blizzard emerges as novel threat actor)

Campaigns / Victims

No campaigns linked yet.

Observed Data

No observed data linked yet.

Indicators of Compromise

No IOCs linked yet.

References

CrowdStrike Ember Bear Profile March 2022 — CrowdStrike. (2022, March 30). Who is EMBER BEAR?. Retrieved June 9, 2022.
Cadet Blizzard emerges as novel threat actor — Microsoft Threat Intelligence. (2023, June 14). Cadet Blizzard emerges as a novel and distinct Russian threat actor. Retrieved July 10, 2023.
Mandiant UNC2589 March 2022 — Sadowski, J; Hall, R. (2022, March 4). Responses to Russia's Invasion of Ukraine Likely to Spur Retaliation. Retrieved June 9, 2022.
Palo Alto Unit 42 OutSteel SaintBot February 2022 — Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
CISA GRU29155 2024 — US Cybersecurity & Infrastructure Security Agency et al. (2024, September 5). Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure. Retrieved September 6, 2024.

Intel Summary

Techniques

Tools

Campaigns

IOCs

Observed Data

Tactics

Details

MITRE ID: G1003
Type: Unknown
Country of Origin: R
Confidence: 90%
Added: May 2, 2026
STIX ID: intrusion-set--a7f57cc1-4540-4429-823f-f4e56b8473c9

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.