Ember Bear
Ember Bear is a Russian state-sponsored cyber espionage group that has been active since at least 2020, linked to Russia's General Staff Main Intelligence Directorate (GRU) 161st Specialist Training Center (Unit 29155). Ember Bear has primarily focused operations against Ukrainian government and telecommunication entities, but has also operated against critical infrastructure entities in Europe and the Americas. Ember Bear conducted the WhisperGate destructive wiper attacks against Ukraine in early 2022. There is some confusion as to whether Ember Bear overlaps with another Russian-linked entity referred to as…
- ATT&CK ID
- G1003
- Origin
- Russia
- Weather family
- Blizzard
- Techniques
- 39
- Tools
- 11
Also tracked as UNC2589 · Bleeding Bear · DEV-0586 · Cadet Blizzard · Frozenvista · UAC-0056
Vulnerabilities it has exploited
- CVE-2021-26084 Atlassian Confluence Server and Data CenterUnscored · exploited in the wild
- CVE-2022-41040 Microsoft Exchange ServerUnscored · exploited in the wild
Techniques
Reconnaissance
Resource Development
Acquire InfrastructureEstablish AccountsObtain Capabilities
Initial Access
Valid AccountsExternal Remote ServicesExploit Public-Facing ApplicationSupply Chain Compromise
Execution
Windows Management InstrumentationScheduled Task/JobCommand and Scripting InterpreterExploitation for Client Execution
Persistence
Scheduled Task/JobValid AccountsModify RegistryExternal Remote ServicesServer Software Component
Privilege Escalation
Scheduled Task/JobValid Accounts
Stealth
MasqueradingIndicator RemovalValid Accounts
Defense Impairment
Credential Access
OS Credential DumpingBrute ForceUnsecured Credentials
Discovery
Remote System DiscoveryNetwork Service DiscoveryLog Enumeration
Lateral Movement
Remote ServicesExploitation of Remote ServicesUse Alternate Authentication MaterialLateral Tool Transfer
Collection
Data from Local SystemEmail CollectionAutomated CollectionVideo CaptureArchive Collected Data
Command and Control
Application Layer ProtocolProxyNon-Application Layer ProtocolNon-Standard PortProtocol Tunneling
Exfiltration
Impact
Software
BloodHound · CrackMapExec · Impacket · P.A.S. Webshell · PsExec · Rclone · Responder · Saint Bot · WhisperGate · ngrok · reGeorg