Ember Bear
Threat actorAttributed to Russia by MITRE ATT&CK (source). An attribution, not a proven fact.
Names and who uses them
- Ember BearOur name
- FrozenvistaCISA
- Bleeding BearCrowdStrike
- UNC2589Mandiant
- Cadet BlizzardMITRE ATT&CK
- DEV-0586MITRE ATT&CK
Targets
Sectors: Government, Telecommunications, Critical infrastructure
Regions: Europe, Ukraine
Source: MITRE ATT&CKKnown techniques
- T1003OS Credential Dumping
- T1003.001LSASS Memory
- T1003.002Security Account Manager
- T1003.004LSA Secrets
- T1005Data from Local System
- T1018Remote System Discovery
- T1021Remote Services
- T1036Masquerading
- T1036.005Match Legitimate Resource Name or Location
- T1046Network Service Discovery
- T1047Windows Management Instrumentation
- T1053.005Scheduled Task
- T1059.001PowerShell
- T1070.004File Deletion
- T1071.004DNS
- T1078.001Default Accounts
- T1090.003Multi-hop Proxy
- T1095Non-Application Layer Protocol
- T1110Brute Force
- T1110.003Password Spraying
- T1112Modify Registry
- T1114Email Collection
- T1119Automated Collection
- T1125Video Capture
- T1133External Remote Services
- T1190Exploit Public-Facing Application
- T1195Supply Chain Compromise
- T1203Exploitation for Client Execution
- T1210Exploitation of Remote Services
- T1491.002External Defacement
- T1505.003Web Shell
- T1550.002Pass the Hash
- T1552.001Credentials In Files
- T1560Archive Collected Data
- T1561.002Disk Structure Wipe
- T1567.002Exfiltration to Cloud Storage
- T1570Lateral Tool Transfer
- T1571Non-Standard Port
- T1572Protocol Tunneling
- T1583Acquire Infrastructure
Malware and tools used
Source: MITRE ATT&CKRecent news
No stories yet.