Ember Bear

Frozenvista is a threat actor tracked under multiple aliases including Bleeding Bear, Cadet Blizzard, DEV-0586, Ember Bear, Frozenvista, Lorec53, Saint Bear, Storm-0587, TA471, UAC-0056, and UNC2589. The content describes activity associated with Ember Bear and Saint Bear, indicating they are related names or sub-group labels used for this actor. The actor is associated with exploitation of public-facing applications for initial access, including web-shell deployment, and with command and scripting interpreter use via PowerShell, Windows Script Host (wscript), and malicious Windows batch scripts. Reported behavior includes using PowerShell to gather information from compromised systems such as email servers; gathering victim system information including device volume details and extracting system and security event logs; using Nmap and MASSCAN for remote system and service discovery; modifying registry values for anti-forensics and defense evasion; disabling Microsoft Defender and Windows Defender functionality through registry changes, scheduled task modification, batch scripts, and use of NirSoft AdvancedRun to stop the WinDefend service; dropping malicious batch files, including ones sourced from public GitHub repositories, to impair defenses; uploading malware and tools; using shared modules; employing anti-analysis and anti-virtualization checks; dumping configuration settings from accessed IP cameras including plaintext credentials; and exfiltrating information to cloud storage, including mega.nz, using tools such as Rclone.