Ember Bear

Cadet Blizzard is a Russia-linked threat actor associated with GRU Unit 29155, also known as the 161st Specialist Training Centre. The group has been tracked under multiple aliases including Ember Bear, Saint Bear, DEV-0586, Bleeding Bear, Lorec53, Storm-0587, TA471, UAC-0056, and UNC2589. It is assessed as part of the Russian state cyber apparatus and has been linked to disruptive and destructive operations aligned with Russian military and hybrid objectives, particularly against Ukraine. Cadet Blizzard is notable for combining espionage, phishing, and destructive activity. The actor has been associated with the January 2022 WhisperGate operation against Ukrainian government organizations, a multi-stage wiper campaign disguised as ransomware and intended to render systems inoperable rather than generate profit. The group has also been linked to intrusion activity against Estonian government entities involving data exfiltration. Reporting on Unit 29155 indicates an evolution from a unit historically known for sabotage and covert physical operations into one conducting cyber operations that support broader Russian state objectives. The actor’s targeting has included government and related entities, especially in Ukraine and Europe. Social engineering and impersonation are recurring features of its operations. Cadet Blizzard has impersonated government-associated organizations in phishing campaigns and has used malicious websites and links designed to mimic legitimate resources. The group has relied on user interaction for execution, including malicious attachments and similar lures. Observed tradecraft includes extensive use of Windows-native tooling and scripting, especially PowerShell and Windows Script Host. Cadet Blizzard has used PowerShell for execution and system reconnaissance, including gathering information from compromised systems such as email servers. It has also used wscript to execute intermediate payloads. Defense evasion is a prominent characteristic: the actor has modified Windows Defender settings through registry changes, altered scheduled tasks and registry entries associated with Defender, and used tooling to stop Defender services and weaken protections. Registry modification has also been used for anti-forensics and broader evasion purposes. Cadet Blizzard has demonstrated collection and staging behaviors beyond destructive attacks. It has engaged in mass collection from compromised systems, exfiltrated imagery from compromised IP cameras, and used legitimate online services to host or stage malicious content. The actor has also been reported to acquire malware and related tooling from dark web forums, indicating a willingness to combine bespoke operations with externally sourced capabilities. Across aliases such as Ember Bear and Saint Bear, the group’s activity spans credential access, remote services abuse, command and scripting interpreter use, proxying, defense impairment, and destructive malware deployment. Overall, Cadet Blizzard represents a Russian military intelligence threat actor focused on disruptive, destructive, and intelligence-supporting cyber operations in service of state objectives.