Introduction
Ember Bear is a Russian state-sponsored cyber espionage group that has been active since at least 2020, linked to Russia’s General Staff Main Intelligence Directorate (GRU) 161st Specialist Training Center (Unit 29155). CISA GRU29155 2024 Ember Bear has primarily focused operations against Ukrainian government and telecommunication entities, but has also operated against critical infrastructure entities in Europe and the Americas. Cadet Blizzard emerges as novel threat actor Ember Bear conducted the WhisperGate destructive wiper attacks against Ukraine in early 2022. CrowdStrike Ember Bear Profile March 2022 Mandiant UNC2589 March 2022 CISA GRU29155 2024 There is some confusion as to whether Ember Bear overlaps with another Russian-linked entity referred to as Saint Bear. At present available evidence strongly suggests these are distinct activities with different behavioral profiles. Cadet Blizzard emerges as novel threat actor Palo Alto Unit 42 OutSteel SaintBot February 2022
Activities and Tactics
Country of Origin: 🇷🇺 Russia
Incident Type: Sabotage
Suspected Victims: Ukraine
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
- T1018 Remote System Discovery
- T1003 OS Credential Dumping
- T1090.003 Multi-hop Proxy
- T1114 Email Collection
- T1583 Acquire Infrastructure
- T1560 Archive Collected Data
- T1036 Masquerading
- T1595.002 Vulnerability Scanning
- T1583.003 Virtual Private Server
- T1654 Log Enumeration
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1119 Automated Collection
- T1571 Non-Standard Port
- T1070.004 File Deletion
- T1570 Lateral Tool Transfer
- T1095 Non-Application Layer Protocol
- T1125 Video Capture
- T1572 Protocol Tunneling
- T1110 Brute Force
- T1588.001 Malware
- T1110.003 Password Spraying
- T1595.001 Scanning IP Blocks
- T1505.003 Web Shell
- T1585 Establish Accounts
- T1491.002 External Defacement
- T1053.005 Scheduled Task
- T1210 Exploitation of Remote Services
- T1059.001 PowerShell
- T1112 Modify Registry
- T1071.004 DNS
- T1550.002 Pass the Hash
- T1567.002 Exfiltration to Cloud Storage
- T1588.005 Exploits
- T1195 Supply Chain Compromise
- T1005 Data from Local System
- T1561.002 Disk Structure Wipe
- T1203 Exploitation for Client Execution
- T1036.005 Match Legitimate Resource Name or Location
- T1552.001 Credentials In Files
- T1003.001 LSASS Memory
- T1047 Windows Management Instrumentation
- T1021 Remote Services
- T1003.004 LSA Secrets
- T1003.002 Security Account Manager
- T1078.001 Default Accounts
- T1046 Network Service Discovery
ATT&CK technique IDs (denormalized)
- T1003
- T1003.001
- T1003.002
- T1003.004
- T1005
- T1018
- T1021
- T1036
- T1036.005
- T1046
- T1047
- T1053.005
- T1059.001
- T1070.004
- T1071.004
- T1078.001
- T1090.003
- T1095
- T1110
- T1110.003
- T1112
- T1114
- T1119
- T1125
- T1133
- T1190
- T1195
- T1203
- T1210
- T1491.002
- T1505.003
- T1550.002
- T1552.001
- T1560
- T1561.002
- T1567.002
- T1570
- T1571
- T1572
- T1583
- T1583.003
- T1585
- T1588.001
- T1588.005
- T1595.001
- T1595.002
- T1654
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
- Wiper:
- CyberGate:
- Cyber Eye RAT:
- Blizzard:
MITRE ATT&CK Software
- P.A.S. Webshell (S0598) — malware
- CrackMapExec (S0488) — tool
- Responder (S0174) — tool
- ngrok (S0508) — tool
- reGeorg (S1187) — malware
- WhisperGate (S0689) — malware
- Saint Bot (S1018) — malware
- PsExec (S0029) — tool
- Rclone (S1040) — tool
- BloodHound (S0521) — tool
- Impacket (S0357) — tool
Russian APT Tool Matrix observations
| Category | Observed tools |
|---|---|
| Discovery | Acunetix, Adminer, Amass, Bloodhound, Droopescan, JoomScan, LdapDomainDump, Masscan, Nmap, WPScan |
| Exfiltration | MEGA, Rclone |
| LOLBAS | PsExec |
| Networking | GOST, Iodine, ProxyChains, ReGeorg, dnscat2 |
| OffSec | CrackMapExec, Impacket, LinPEAS, Metasploit, Meterpreter, NetCat, PAS Web Shell, Responder, WSO Web Shell |
Attribution and Evidence
Country of Origin: Russia Additional attribution information pending cataloguing.
References
[1] mitre-attack [8] CrowdStrike Ember Bear Profile March 2022 CrowdStrike. (2022, March 30). Who is EMBER BEAR?. Retrieved June 9, 2022. [9] Cadet Blizzard emerges as novel threat actor Microsoft Threat Intelligence. (2023, June 14). Cadet Blizzard emerges as a novel and distinct Russian threat actor. Retrieved July 10, 2023. [10] Mandiant UNC2589 March 2022 Sadowski, J; Hall, R. (2022, March 4). Responses to Russia’s Invasion of Ukraine Likely to Spur Retaliation. Retrieved June 9, 2022. [11] Palo Alto Unit 42 OutSteel SaintBot February 2022 Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022. [12] CISA GRU29155 2024 US Cybersecurity & Infrastructure Security Agency et al. (2024, September 5). Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure. Retrieved September 6, 2024.