Security Resilience

Threat actor · all actors

Ember BearG1003 state

🇷🇺 RU

aka Ember Bear, UNC2589, Bleeding Bear, DEV-0586, Cadet Blizzard, Frozenvista, UAC-0056, SaintBear, TA471, Nascent Ursa, Nodaria, Storm-0587, DEV-0587, Saint Bear, Lorec53, Lorec Bear, Ruinous Ursa

Last updated: 2026-10-16

11attributed CVEs
61ATT&CK techniques
29.7IDF score (tooling uniqueness)
0exclusive CVEs
2020–2026years active

About this actor

[Ember Bear](https://attack.mitre.org/groups/G1003) is a Russian state-sponsored cyber espionage group that has been active since at least 2020, linked to Russia's General Staff Main Intelligence Directorate (GRU) 161st Specialist Training Center (Unit 29155).(Citation: CISA GRU29155 2024) [Ember Bear](https://attack.mitre.org/groups/G1003) has primarily focused operations against Ukrainian government and telecommunication entities, but has also operated against critical infrastructure entities in Europe and the Americas.(Citation: Cadet Blizzard emerges as novel threat actor) [Ember Bear](https://attack.mitre.org/groups/G1003) conducted the [WhisperGate](https://attack.mitre.org/software/S0689) destructive wiper attacks against Ukraine in early 2022.(Citation: CrowdStrike Ember Bear Profile March 2022)(Citation: Mandiant UNC2589 March 2022)(Citation: CISA GRU29155 2024) There is some confusion as to whether [Ember Bear](https://attack.mitre.org/groups/G1003) overlaps with another Russian-linked entity referred to as [Saint Bear](https://attack.mitre.org/groups/G1031). At present available evidence strongly suggests these are distinct activities with different behavioral profiles.(Citation: Cadet Blizzard emerges as novel threat actor)(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )

Source: MITRE ATT&CK

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

MITRE ATT&CKG-number catalogue id

G1003

Microsoftweather-system names

Cadet BlizzardStorm-0587

CrowdStrikenation-animal names

Ember BearBleeding BearSaint BearLorec Bear

MandiantUNC uncategorised cluster

UNC2589

CERT-UAUAC cluster id

UAC-0056

ProofpointTA threat-actor id

TA471

Unclassifiedno scheme matched

DEV-0586FrozenvistaSaintBearNascent UrsaNodariaDEV-0587Lorec53Ruinous Ursa

How we know this

Data origin
MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
Techniques
MITRE ATT&CK STIX mappings — 61 ATT&CK techniques on file.
Named victims
None on file.

See how actor data is built for the full pipeline.

Activity timeline

2020: 1 CVE published120202021: 4 CVE published2021: 2 KEV added620212022: 5 CVE published2022: 5 KEV added1020222024: 2 KEV added220242026: 1 CVE published12026
CVE publishedKEV added

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2021-26084 KEV9.99.81.00002021-08-30see CVE
CVE-2021-33044 KEV9.99.80.99992021-09-15see CVE
CVE-2021-33045 KEV9.99.80.99592021-09-15see CVE
CVE-2022-26134 KEV9.99.81.00002022-06-03see CVE
CVE-2022-26138 KEV9.99.80.98242022-07-20see CVE
CVE-2022-3236 KEV9.99.80.98902022-09-23see CVE
CVE-2021-3156 KEV8.57.80.99972021-01-26see CVE
CVE-2021-4034 KEV8.57.80.94922022-01-28see CVE
CVE-2020-1472 KEV7.55.50.99512020-08-17see CVE
CVE-2022-27666 6.57.80.05522022-03-23see CVE
CVE-2026-20929 6.27.50.02912026-01-13see CVE

Mitigating controls (NIST 800-53)

ControlTechniques coveredCoverage
SI-443 / 6170%
AC-339 / 6164%
CM-237 / 6161%
CM-637 / 6161%
AC-636 / 6159%
AC-229 / 6148%
SI-329 / 6148%
CA-728 / 6146%
CM-726 / 6143%
AC-523 / 6138%
IA-222 / 6136%
AC-421 / 6134%
SI-721 / 6134%
SC-720 / 6133%
CM-518 / 6130%

Co-occurring actors

Similar actors

Similar TTPs

Overlapping CVEs

Active in same years

Same nation-state

Same category