Actors/Nation-state / APT/Europe

Ember Bear

G1003APTRU · Russia

AKA Cadet Blizzard · Bleeding Bear · Saint Bear · Lorec53 · UAC-0056 · FROZENVISTA · Nodaria

Mandiant: UNC2589Microsoft: DEV-0586MITRE: G1003

GRU cluster responsible for WhisperGate wiper attacks on Ukraine.

Targets16

Sectors2

Threat types2

GIRs mapped0/480

Active since2020

Explore in atlas

Also tracked as

4 vendor names · 7 other aliases

Open Rosetta Stone

CrowdStrike

Ember Bear

Mandiant

UNC2589

Microsoft

DEV-0586

MITRE

G1003

UNATTRIBUTED ALIASESCadet BlizzardBleeding BearSaint BearLorec53UAC-0056FROZENVISTANodaria

Victimology

Geographic footprint · 16 countries

Export STIX

origin · Russiatargeted countries · 16

EUROPE · 10

Austria · Belgium · Germany · Denmark · France · United Kingdom · Lithuania · Latvia · Poland · Ukraine

OCEANIA · 1

Australia

ASIA · 4

Georgia · India · Malaysia · Saudi Arabia

AMERICAS · 1

United States

Sectors targeted

2 of 40

Government100 actors Defense72 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

DIS · DisinformationESP · Espionage

MITRE ATT&CK · 47 techniques

Reconnaissance · 1

T1589.002Email Addresses

Resource Development · 4

T1583Acquire Infrastructure T1583.003Virtual Private Server T1583.006Web Services T1585Establish Accounts

Initial Access · 3

T1190Exploit Public-Facing Application

Execution · 8

T1047Windows Management Instrumentation

Credential Access · 6

T1003OS Credential Dumping

Discovery · 3

T1018Remote System Discovery T1046Network Service Discovery

Lateral Movement · 4

T1021Remote Services

Collection · 4

T1005Data from Local System T1119Automated Collection

Exfiltration · 1

T1567.002Exfiltration to Cloud Storage

Impact · 1

T1561.002Disk Structure Wipe

Command And Control · 4

T1071.004DNS

Defense Impairment · 2

T1112Modify Registry

Stealth · 6

T1027.002Software Packing T1036Masquerading T1036.005Match Legitimate Resource Name or Location

GIR mappings

0 / 480 requirements mapped

Open matrix

No GIRs mapped yet for this actor.

References

No supporting references have been recorded for this profile. Treat uncited claims as unverified.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer47 techniques · layer format 4.5

Related actors

By origin and actor type

T1195

Supply Chain Compromise

T1566.001Spearphishing Attachment

T1053.005

Scheduled Task

T1059Command and Scripting Interpreter

T1059.001PowerShell

T1059.003Windows Command Shell

T1059.007JavaScript

T1203Exploitation for Client Execution

T1204.001Malicious Link

T1003.001

LSASS Memory

T1003.002Security Account Manager

T1003.004LSA Secrets

T1110Brute Force

T1552.001Credentials In Files

T1654

Log Enumeration

T1210

Exploitation of Remote Services

T1550.002Pass the Hash

T1570Lateral Tool Transfer

T1125

Video Capture

T1560Archive Collected Data

T1090.003

Multi-hop Proxy

T1095Non-Application Layer Protocol

T1571Non-Standard Port

T1685

Disable or Modify Tools

T1070.004

File Deletion

T1497Virtualization/Sandbox Evasion

T1684.001Impersonation