Threat Actor Characterization
Ember Bear
ID: 88c97d960b72db10e568660ee89430ff48525| Cadet Blizzard | Lorec53 | No***** | Sa******** |
| St******** | T**** | UA****** | UN***** |
Actor Network Graph
Open Network GraphMITRE ATT&CK®
Ember Bear (G1003) — Russia-nexus actor targeting Ukraine and allied sectors with phishing/drive-by access, backdoors (e.g., GrimPlant/GraphSteel), credential abuse, data theft for IO, and selective destructive activity (e.g., WhisperGate).
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1566 | Phishing | TA0001 |
|
| T1189 | Drive-by Compromise | TA0001 |
|
| T1078 | Valid Accounts | TA0001 TA0003 TA0004 TA0005 |
|
| T1105 | Ingress Tool Transfer | TA0011 |
|
| T1041 | Exfiltration Over C2 Channel | TA0010 |
|
| T1561 | Disk Wipe | TA0040 |
|
CLASSIFICATION: Unclassified / Open Source
Executive Summary
Ember Bear is a Russia-nexus intrusion and influence-enabling actor tracked by MITRE as G1003 and by vendors/governments under aliases including UAC-0056, TA471, UNC2589, Lorec53, Nodaria (and sometimes conflated with Saint Bear / Cadet Blizzard / Storm-0587). Public analysis ties portions of the cluster to GRU Unit 29155; observed objectives include credentialed access, data theft, and support to information operations, with destructive activity (e.g., WhisperGate wiper against Ukraine, January 2022) cited in several assessments. Targeting has centered on Ukraine’s government/telecoms, with spillover to European/Americas critical infrastructure entities. Confidence: high on targeting/TTPs; medium on precise sub-cluster boundaries and naming.
Russian state-aligned cluster focused on operational access that can be weaponized for IO/psychological impact and, episodically, disruption. CrowdStrike emphasizes intent to erode public trust and degrade government response by pairing intrusions with narrative operations.
Strategic objectives: (1) Intelligence collection and options for follow-on effects; (2) perception shaping via timed leaks/claims; (3) selective destructive actions in wartime contexts. Public-facing claims and wiper events amplified fear and uncertainty around Ukraine’s institutions in early 2022.