Ember BearG1003 state

About this actor

[Ember Bear](https://attack.mitre.org/groups/G1003) is a Russian state-sponsored cyber espionage group that has been active since at least 2020, linked to Russia's General Staff Main Intelligence Directorate (GRU) 161st Specialist Training Center (Unit 29155).(Citation: CISA GRU29155 2024) [Ember Bear](https://attack.mitre.org/groups/G1003) has primarily focused operations against Ukrainian government and telecommunication entities, but has also operated against critical infrastructure entities in Europe and the Americas.(Citation: Cadet Blizzard emerges as novel threat actor) [Ember Bear](https://attack.mitre.org/groups/G1003) conducted the [WhisperGate](https://attack.mitre.org/software/S0689) destructive wiper attacks against Ukraine in early 2022.(Citation: CrowdStrike Ember Bear Profile March 2022)(Citation: Mandiant UNC2589 March 2022)(Citation: CISA GRU29155 2024) There is some confusion as to whether [Ember Bear](https://attack.mitre.org/groups/G1003) overlaps with another Russian-linked entity referred to as [Saint Bear](https://attack.mitre.org/groups/G1031). At present available evidence strongly suggests these are distinct activities with different behavioral profiles.(Citation: Cadet Blizzard emerges as novel threat actor)(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )

Source: MITRE ATT&CK

Activity timeline

• 2026 — 1 CVE published
• 2022 — 1 CVE published

Profile

Mitigating controls (NIST 800-53)

Co-occurring actors

• Mustang Panda 1 shared CVEs
• SolarWinds Compromise 1 shared CVEs
• APT38 1 shared CVEs
• Tonto Team 1 shared CVEs
• GOLD SOUTHFIELD 1 shared CVEs
• Aquatic Panda 1 shared CVEs
• APT28 1 shared CVEs
• Sandworm Team 1 shared CVEs
• Ajax Security Team 1 shared CVEs
• FIN7 1 shared CVEs

Similar actors