Ember Bear

MITRE ATT&CK: G1003 View on attack.mitre.org

Aliases: UNC2589, Bleeding Bear, DEV-0586, Cadet Blizzard, Frozenvista, UAC-0056, TA471, Nascent Ursa, Nodaria, FROZENVISTA, Storm-0587, DEV-0587, Saint Bear, Lorec53, EMBER BEAR, Lorec Bear, Ruinous Ursa, Ember Bear

First seen
2020-01-01 00:00:00
Origin
RU
Primary motivation
espionage
Sophistication
advanced
Resource level
government
Actor type
Sabotage
Profile updated
2026-07-07 12:32:32

Targeted industries: government-and-public-sector technology-and-telecommunications energy-and-utilities

Targeted regions: country_code:ua country_code:pl country_code:us

Context

Ember Bear is a Russian state-sponsored cyber espionage group that has been active since at least 2020, linked to Russia's General Staff Main Intelligence Directorate (GRU) 161st Specialist Training Center (Unit 29155). Ember Bear has primarily focused operations against Ukrainian government and telecommunication entities, but has also operated against critical infrastructure entities in Europe and the Americas. Ember Bear conducted the WhisperGate destructive wiper attacks against Ukraine in early 2022. There is some confusion as to whether Ember Bear overlaps with another Russian-linked entity referred to as Saint Bear. At present available evidence strongly suggests these are distinct activities with different behavioral profiles.

Detection coverage

  • 11 YARA rules
  • 846 Sigma rules

Malware & tools used

  • OS Credential Dumping (attack-pattern)
  • Multi-hop Proxy (attack-pattern)
  • Email Collection (attack-pattern)
  • Acquire Infrastructure (attack-pattern)
  • Archive Collected Data (attack-pattern)
  • Masquerading (attack-pattern)
  • Vulnerability Scanning (attack-pattern)
  • Virtual Private Server (attack-pattern)
  • Log Enumeration (attack-pattern)
  • Exploit Public-Facing Application (attack-pattern)
  • External Remote Services (attack-pattern)
  • Automated Collection (attack-pattern)
  • Non-Standard Port (attack-pattern)
  • File Deletion (attack-pattern)
  • Lateral Tool Transfer (attack-pattern)
  • Non-Application Layer Protocol (attack-pattern)
  • Video Capture (attack-pattern)
  • Protocol Tunneling (attack-pattern)
  • Brute Force (attack-pattern)
  • Malware (attack-pattern)
  • Password Spraying (attack-pattern)
  • Scanning IP Blocks (attack-pattern)
  • Web Shell (attack-pattern)
  • Establish Accounts (attack-pattern)
  • External Defacement (attack-pattern)

Reports & references

  • blog.google — Fog Of War How The Ukraine Conflict Transformed The Cyber Threat Landscape (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Graphsteel (report)
  • CERT-UA — 38374 (report)
  • blog.malwarebytes.com — New Uac 0056 Activity Theres A Go Elephant In The Room (report)
  • intezer.com — Elephant Malware Targeting Ukrainian Orgs (report)
  • sentinelone.com — Threat Actor Uac 0056 Targeting Ukraine With Fake Translation Software (report)
  • Palo Alto Unit 42 — Nascentursa (report)
  • Broadcom/Symantec — Nodaria Ukraine Infostealer (report)
  • Microsoft — Cadet Blizzard Emerges As A Novel And Distinct Russian Threat Actor (report)
  • circleid.com — 20230412 Probing Lorec53 Phishing Through The Dns Microscope (report)
  • nsfocusglobal.com — Analysis Report On Lorec53 Group (report)
  • CrowdStrike — Who Is Ember Bear (report)
  • MITRE ATT&CK — G1003 (report)
  • Microsoft — Destructive Malware Targeting Ukrainian Organizations (report)
  • Microsoft — Analysis Resources Cyber Threat Activity Ukraine (report)
  • Palo Alto Unit 42 — Ruinousursa (report)
  • Microsoft — Actinium Targets Ukrainian Organizations (report)
  • raw.githubusercontent.com — Microsoftmapping (report)
  • Microsoft — Microsoft Threat Actor Naming (report)
  • Palo Alto Unit 42 — Ukraine Targeted Outsteel Saintbot (report)
  • CISA — Aa24 249A Russian Military Cyber Actors Target Us And Global Critical Infrastructure (report)
  • CrowdStrike — Who Is Ember Bear (report)
  • Mandiant — Russia Invasion Ukraine Retaliation (report)

Attributed from

  • Unit 29155 Russian Military Cyber Activity (campaign)

External references