Ember Bear

Ember Bear is a Russian state-sponsored threat actor associated with Russia's military intelligence service, the GRU, including Unit 29155. Active since at least March 2021, it conducts cyberespionage and destructive operations, primarily against Ukraine and Georgia. It is also tracked as Cadet Blizzard, DEV-0586, UNC2589, UAC-0056, Saint Bear, Bleeding Bear, Lorec53, TA471, Nodaria, Nascent Ursa, LorecBear, FrozenVista, and Storm-0587. Its targets include government and diplomatic institutions, defense organizations, energy companies, technology providers, financial institutions, pharmaceutical organizations, and nonprofits. The actor uses spear-phishing, spoofed sender identities, malicious Office macros, shortcut files, and multistage loaders. Lures exploit government correspondence, evacuation plans, public-health issues, and employment themes. Its tooling includes Graphiron, the Elephant framework's GrimPlant backdoor and GraphSteel information stealer, OutSteel, BabaDeda, SaintBot, and Cobalt Strike Beacon. These tools support document collection, credential and private-key theft, screenshots, keystroke capture, remote command execution, reconnaissance, and network pivoting. Persistence mechanisms include startup shortcuts, autorun configuration, and services. Defense-evasion techniques include packing, obfuscation, anti-analysis checks, process injection, process hollowing, and interference with Microsoft Defender. The actor also uses Rclone to exfiltrate data to cloud storage. In January 2022, the actor deployed WhisperGate against Ukrainian government, nonprofit, and information technology organizations before Russia's full-scale invasion. WhisperGate masqueraded as ransomware but was designed to destroy data, overwrite boot records, corrupt files, and render systems inoperable rather than provide a viable recovery mechanism. These operations targeted Ukrainian institutional capacity and operational readiness.