CVE Intelligence
Home / Threat actors / Ember Bear

Ember Bear G1003

🔔 Create alert

Also known as: UNC2589, Bleeding Bear, DEV-0586, Cadet Blizzard, Frozenvista, UAC-0056

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

2
associated CVEs
54
Techniques
11
Malware and tools

Ember Bear is a Russian state-sponsored cyber espionage group that has been active since at least 2020, linked to Russia's General Staff Main Intelligence Directorate (GRU) 161st Specialist Training Center (Unit 29155). Ember Bear has primarily focused operations against Ukrainian government and telecommunication entities, but has also operated against critical infrastructure entities in Europe and the Americas. Ember Bear conducted the WhisperGate destructive wiper attacks against Ukraine in early 2022. There is some confusion as to whether Ember Bear overlaps with another Russian-linked entity referred to as Saint Bear. At present available evidence strongly suggests these are distinct activities with different behavioral profiles.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2022-41040 High · 8.8 KEV Ransomware Microsoft Exchange Server Server-Side Request Forgery Vulnerability
“Examples include exploitation of CVE-2021-26084 in Confluence servers; CVE-2022-41040, ProxyShell, and other vulnerabilities in Microsoft Exchange; and multiple vulnerabilities in open-source platforms such as content management systems.”
CVE-2021-26084 Critical · 9.8 KEV Ransomware Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability
“Examples include exploitation of CVE-2021-26084 in Confluence servers; CVE-2022-41040, ProxyShell, and other vulnerabilities in Microsoft Exchange; and multiple vulnerabilities in open-source platforms such as content management systems.”

Techniques by tactic

Reconnaissance
T1595.001 Scanning IP BlocksT1595.002 Vulnerability Scanning
Resource Development
T1583 Acquire InfrastructureT1583.003 Virtual Private ServerT1585 Establish AccountsT1588.001 MalwareT1588.005 Exploits
Initial Access
T1078.001 Default AccountsT1133 External Remote ServicesT1190 Exploit Public-Facing ApplicationT1195 Supply Chain Compromise
Execution
T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059.001 PowerShellT1203 Exploitation for Client Execution
Persistence
T1053.005 Scheduled TaskT1078.001 Default AccountsT1112 Modify RegistryT1133 External Remote ServicesT1505.003 Web Shell
Privilege Escalation
T1053.005 Scheduled TaskT1078.001 Default Accounts
Stealth
T1036 MasqueradingT1036.005 Match Legitimate Resource Name or LocationT1070.004 File DeletionT1078.001 Default Accounts
Defense Impairment
T1112 Modify Registry
Credential Access
T1003 OS Credential DumpingT1003.001 LSASS MemoryT1003.002 Security Account ManagerT1003.004 LSA SecretsT1110 Brute ForceT1110.003 Password SprayingT1552.001 Credentials In Files
Discovery
T1018 Remote System DiscoveryT1046 Network Service DiscoveryT1654 Log Enumeration
Lateral Movement
T1021 Remote ServicesT1210 Exploitation of Remote ServicesT1550.002 Pass the HashT1570 Lateral Tool Transfer
Collection
T1005 Data from Local SystemT1114 Email CollectionT1119 Automated CollectionT1125 Video CaptureT1560 Archive Collected Data
Command and Control
T1071.004 DNST1090.003 Multi-hop ProxyT1095 Non-Application Layer ProtocolT1571 Non-Standard PortT1572 Protocol Tunneling
Exfiltration
T1567.002 Exfiltration to Cloud Storage
Impact
T1491.002 External DefacementT1561.002 Disk Structure Wipe

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.