Ember Bear
IntrusionSet · ATTACK:enterprise:G1003
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G1003",
"title": "Ember Bear",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G1003",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--a7f57cc1-4540-4429-823f-f4e56b8473c9",
"external_id": "G1003",
"domain": "enterprise",
"created": "2022-06-09T14:49:57.704Z",
"modified": "2026-07-31T18:48:12.127Z",
"version": "2.1",
"aliases": [
"Ember Bear",
"UNC2589",
"Bleeding Bear",
"DEV-0586",
"Cadet Blizzard",
"Frozenvista",
"UAC-0056"
],
"tactics": [
],
"source_references": [
{
"source_name": "DEV-0586"
},
{
"source_name": "Cadet Blizzard"
},
{
"source_name": "Frozenvista"
},
{
"source_name": "UAC-0056"
},
{
"source_name": "Bleeding Bear"
},
{
"source_name": "UNC2589"
},
{
"source_name": "CrowdStrike Ember Bear Profile March 2022",
"url": "https://www.crowdstrike.com/blog/who-is-ember-bear/"
},
{
"source_name": "Cadet Blizzard emerges as novel threat actor",
"url": "https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"
},
{
"source_name": "Mandiant UNC2589 March 2022",
"url": "https://www.mandiant.com/resources/russia-invasion-ukraine-retaliation"
},
{
"source_name": "Palo Alto Unit 42 OutSteel SaintBot February 2022 ",
"url": "https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"
},
{
"source_name": "CISA GRU29155 2024",
"url": "https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"
}
]
}Explicit source assertions (58)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--01b94982-fedb-4469-adf1-7f2a2a9069ea
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0314a845-98db-4cf9-ac05-875025017636
Cadet Blizzard emerges as novel threat actorATTACK:enterprise:G1003 → uses → ATTACK:enterprise:S0598
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0b703c87-b5a9-4e54-9db9-23d7288c2060
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1090.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--103964f0-77c2-4a20-8026-4e3b5ec1ede0
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1114
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--168f7ba7-346f-4c70-a08d-f9a13db33c3e
Cadet Blizzard emerges as novel threat actor · CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1583
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--21972d6c-e581-40e3-91f3-7aaa48f86885
Cadet Blizzard emerges as novel threat actorATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1560
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2e3dd466-e330-4d59-9c23-59f1f697d60d
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1036
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--33134dd2-7bc5-47a1-a06a-101f3ecf2878
Cadet Blizzard emerges as novel threat actorATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1595.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--35b0668b-312b-4cf4-baff-cda407575dc4
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1583.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--35bfa368-bdf2-4a1e-8723-dafb788d5ddf
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1654
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--36ac187b-e0a4-4603-8c83-49d71f88df7b
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--37306ec5-a50c-43a5-aa02-08b2179fb09d
Cadet Blizzard emerges as novel threat actor · CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1133
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3ac252c3-1505-4bbe-9093-de7f9ef3f7b5
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1119
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3b7d8e64-9f14-486a-aae3-170834dac98c
Cadet Blizzard emerges as novel threat actorATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1571
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3cae7fc8-e671-486b-a431-791a32df92a7
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3dfd09c1-dde9-4bbf-9cfc-57b263b91284
Cadet Blizzard emerges as novel threat actorATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1570
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--405cbf25-6efb-4f58-90cf-609909be9a48
Cadet Blizzard emerges as novel threat actorATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1095
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--43edcf0f-1f37-48b6-aa89-aa845611e0f3
Cadet Blizzard emerges as novel threat actor · CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1125
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4c823ae9-ac1e-4f09-bb1a-5e573938fc29
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--50b91e01-e769-4164-a01e-57951e2e8348
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1110
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--54b880ab-5c20-4689-9fbc-a6beed8874a1
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1588.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5a4abc29-8750-4fad-a7b8-c10bd8b1da8a
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1110.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--67e281a2-0bbc-4a6e-a9a7-3f22649f9d14
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1595.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--68876423-7dbc-4f68-9b2b-848184338395
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1505.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6ecd9294-8818-4de9-a871-38d514380bd8
Cadet Blizzard emerges as novel threat actor · CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1585
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7121d134-bda1-46a1-aa6c-64609e58603c
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:S0488
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--71b0e83e-8b1e-41ea-b7ec-35f66a3ee9d8
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1491.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--73fe8b0c-2d4f-422f-b244-72f7e991cdd5
Cadet Blizzard emerges as novel threat actorATTACK:enterprise:G1003 → uses → ATTACK:enterprise:S0174
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--743cd60e-8fa7-40ad-b99d-075da089ba05
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7a255276-de2b-466b-bb8c-f274e7b4adae
Cadet Blizzard emerges as novel threat actorATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1210
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--81cd9ad2-32ce-4a24-88cb-7dbe94c5a9f1
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8d0b1911-1443-4821-b2a3-c0c21306083c
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--93570192-4fb5-4d8a-98a7-1f4bb7c2b986
Cadet Blizzard emerges as novel threat actorATTACK:enterprise:G1003 → uses → ATTACK:enterprise:S0508
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9b88e4d5-7a81-4167-95b3-63b10d88ea29
Cadet Blizzard emerges as novel threat actorATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a01fe77e-2091-4938-b639-21d21704c7a2
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:S1187
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a027e61a-5183-4a2c-9b1a-b2156f3b4546
Cadet Blizzard emerges as novel threat actorATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1550.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a62e2165-9f7e-44ed-8523-7e3a805a94db
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1567.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a71e213d-1e14-4ac6-8d93-97c180ac8502
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:S0689
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a9200a4f-271b-4b13-864b-a3e21de3c9f2
CrowdStrike Ember Bear Profile March 2022 · Cadet Blizzard emerges as novel threat actor · Mandiant UNC2589 March 2022ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:S1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ab225de5-cdbc-4026-87ee-f64d3c22336d
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1588.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--af2fa05b-f278-448e-aa8b-6e24af194484
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1195
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b0be4fe2-f93c-4b7b-8cd4-d0f8a3508c26
Cadet Blizzard emerges as novel threat actorATTACK:enterprise:G1003 → uses → ATTACK:enterprise:S0029
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c2384bea-763a-4782-ba88-15a75d83f61b
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c37afb06-a8bb-48ac-ba38-a09bdc8833a9
Cadet Blizzard emerges as novel threat actor · CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1561.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cb495609-5a69-49f1-afb4-4bfa2c9a38f8
Cadet Blizzard emerges as novel threat actorATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1203
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d3f7e788-7479-41f7-8efc-35b8f2a914f4
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:S1040
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d433a8af-05f0-4766-adb5-abc63f9bf1b9
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d76a4696-ace5-4951-9733-a63a49479240
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:S0521
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d9ed5461-b123-4cb8-88e7-b24675858747
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1552.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--de1f960b-9f59-4113-8e07-bdb534303ab0
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1003.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e27996c5-9aae-4b5f-b84f-e76a29f51a09
Cadet Blizzard emerges as novel threat actor · CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e38d9f5e-70bd-40ed-8164-565caab36b65
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:S0357
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e7169878-e45d-40ec-a579-6dd12d710cc3
Cadet Blizzard emerges as novel threat actor · CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1021
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e7240735-0936-49b9-a4ff-16cb0aa06e07
Cadet Blizzard emerges as novel threat actorATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1003.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--efee6215-08f7-40d2-a495-e9e3d55bd822
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1003.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eff75944-0c22-45bb-bda5-db848836f02b
Cadet Blizzard emerges as novel threat actor · CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1078.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fa38f089-4ab6-464b-aab6-df2a0f0bdc6e
CISA GRU29155 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1046
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ff9369b6-62d2-46fd-acc9-ba20fdae8fac
CISA GRU29155 2024