Ember Bear - G1003

Created: 2022-06-09T14:49:57.704Z

Modified: 2023-03-22T03:40:53.311Z

Contributors: Hannah Simes, BT Security

Aliases

Ember Bear,Saint Bear,UNC2589,UAC-0056,Lorec53,Lorec Bear,Bleeding Bear

Description

Ember Bear is a suspected Russian state-sponsored cyber espionage group that has been active since at least March 2021. Ember Bear has primarily focused their operations against Ukraine and Georgia, but has also targeted Western European and North American foreign ministries, pharmaceutical companies, and financial sector organizations. Security researchers assess Ember Bear likely conducted the WhisperGate destructive wiper attacks against Ukraine in early 2022.(Citation: CrowdStrike Ember Bear Profile March 2022)(Citation: Mandiant UNC2589 March 2022)(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )

Techniques Used

Ember Bear has obfuscated malicious scripts to help avoid detection.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )|
|mitre-attack|enterprise-attack|PRE|T1588.003|Code Signing Certificates|

Ember Bear has stolen legitimate certificates to sign malicious payloads.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )|
|mitre-attack|enterprise-attack|Windows|T1218.002|Control Panel|

Ember Bear has used control panel files (CPL), delivered via e-mail, for execution.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Ember Bear has used tools to download malicious code.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )|
|mitre-attack|enterprise-attack|macOS,Windows|T1553.002|Code Signing|

Ember Bear has used stolen certificates from Electrum Technologies GmbH to sign payloads.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )|
|mitre-attack|enterprise-attack|Windows|T1112|Modify Registry|