Cadet Blizzard emerges as novel threat actor

Ember Bear gathers credential material from target systems, such as SSH keys, to facilitate access to victim environments.

Ember Bear uses legitimate Sysinternals tools such as procdump to dump LSASS memory.

Ember Bear acquires victim credentials by extracting registry hives such as the Security Account Manager through commands such as reg save.

Ember Bear gathers victim system information such as enumerating the volume of a given device or extracting system and security event logs for analysis.

Ember Bear uses valid network credentials gathered through credential harvesting to move laterally within victim networks, often employing the Impacket framework to do so.

Ember Bear has renamed the legitimate Sysinternals tool procdump to alternative names such as dump64.exe to evade detection.

Ember Bear uses remotely scheduled tasks to facilitate remote command execution on victim machines.

Ember Bear deletes files related to lateral movement to avoid detection.

Ember Bear uses socket-based tunneling utilities for command and control purposes such as NetCat and Go Simple Tunnel (GOST). These tunnels are used to push interactive command prompts over the created sockets. Ember Bear has also used reverse TCP connections from Meterpreter installations to communicate back with C2 infrastructure.

Ember Bear modifies registry values for anti-forensics and defense evasion purposes.

Ember Bear attempts to collect mail from accessed systems and servers.

Ember Bear engages in mass collection from compromised systems during intrusions.

Ember Bear gains initial access to victim environments by exploiting external-facing services. Examples include exploitation of CVE-2021-26084 in Confluence servers; CVE-2022-41040, ProxyShell, and other vulnerabilities in Microsoft Exchange; and multiple vulnerabilities in open-source platforms such as content management systems.

Ember Bear has compromised information technology providers and software developers providing services to targets of interest, building initial access to ultimate victims at least in part through compromise of service providers that work with the victim organizations.

Saint Bear has, in addition to email-based phishing attachments, used malicious websites masquerading as legitimate entities to host links to malicious files for user execution.

Ember Bear is linked to the defacement of several Ukrainian organization websites.

reGeorg is a web shell that has been installed on exposed web servers for access to victim environments.

Ember Bear deploys web shells following initial access for either follow-on command execution or protocol tunneling. Example web shells used by Ember Bear include P0wnyshell, reGeorg, P.A.S. Webshell, and custom variants of publicly-available web shell examples.

Ember Bear conducted destructive operations against victims, including disk structure wiping, via the WhisperGate malware in Ukraine.

Ember Bear retrieves follow-on payloads direct from adversary-owned infrastructure for deployment on compromised hosts.

reGeorg can tunnel TCP sessions including RDP, SSH, and SMB through HTTP.

Ember Bear uses services such as IVPN, SurfShark, and Tor to add anonymization to operations.

Saint Bear has impersonated government and related entities in both phishing activity and developing web sites with malicious links that mimic legitimate resources.