CISA GRU29155 2024

Ember Bear uses legitimate Sysinternals tools such as procdump to dump LSASS memory.

Ember Bear acquires victim credentials by extracting registry hives such as the Security Account Manager through commands such as reg save.

Ember Bear has used frameworks such as Impacket to dump LSA secrets for credential capture.

Ember Bear gathers victim system information such as enumerating the volume of a given device or extracting system and security event logs for analysis.

Ember Bear has used tools such as Nmap and MASSCAN for remote service discovery.

Ember Bear has renamed tools to match legitimate utilities, such as renaming GOST tunneling instances to `java` in victim environments.

Ember Bear has used tools such as NMAP for remote system discovery and enumeration in victim environments.

Ember Bear has used WMI execution with password hashes for command execution and lateral movement.

Ember Bear has used PowerShell commands to gather information from compromised systems, such as email servers.

Ember Bear has used DNS tunnelling tools, such as dnscat/2 and Iodine, for C2 purposes.

Ember Bear has abused default user names and passwords in externally-accessible IP cameras for initial access.

Ember Bear has configured multi-hop proxies via ProxyChains within victim environments.

Ember Bear uses socket-based tunneling utilities for command and control purposes such as NetCat and Go Simple Tunnel (GOST). These tunnels are used to push interactive command prompts over the created sockets. Ember Bear has also used reverse TCP connections from Meterpreter installations to communicate back with C2 infrastructure.

Ember Bear used the `su-bruteforce` tool to brute force specific users using the `su` command.

Ember Bear has conducted password spraying against Outlook Web Access (OWA) infrastructure to identify valid user names and passwords.

Ember Bear attempts to collect mail from accessed systems and servers.

Ember Bear has exfiltrated images from compromised IP cameras.

Ember Bear have used VPNs both for initial access to victim environments and for persistence within them following compromise.

Ember Bear gains initial access to victim environments by exploiting external-facing services. Examples include exploitation of CVE-2021-26084 in Confluence servers; CVE-2022-41040, ProxyShell, and other vulnerabilities in Microsoft Exchange; and multiple vulnerabilities in open-source platforms such as content management systems.

Ember Bear has used exploits to enable follow-on execution of frameworks such as Meterpreter.

Ember Bear has used exploits for vulnerabilities such as MS17-010, also known as `Eternal Blue`, during operations.

Ember Bear deploys web shells following initial access for either follow-on command execution or protocol tunneling. Example web shells used by Ember Bear include P0wnyshell, reGeorg, P.A.S. Webshell, and custom variants of publicly-available web shell examples.

Ember Bear has used pass-the-hash techniques for lateral movement in victim environments.

Ember Bear has dumped configuration settings in accessed IP cameras including plaintext credentials.

Ember Bear has compressed collected data prior to exfiltration.

Ember Bear has used tools such as Rclone to exfiltrate information from victim environments to cloud storage such as `mega.nz`.

Ember Bear has used various non-standard ports for C2 communication.

Ember Bear has used ProxyChains to tunnel protocols to internal networks.

Ember Bear has used virtual private servers (VPSs) to host tools, perform reconnaissance, exploit victim infrastructure, and as a destination for data exfiltration.

Ember Bear has created accounts on dark web forums to obtain various tools and malware.

Ember Bear has acquired malware and related tools from dark web forums.

Ember Bear has obtained exploitation scripts against publicly-disclosed vulnerabilities from public repositories.

Ember Bear has targeted IP ranges for vulnerability scanning related to government and critical infrastructure organizations.

Ember Bear has used publicly available tools such as MASSCAN and Acunetix for vulnerability scanning of public-facing infrastructure.

Ember Bear has enumerated SECURITY and SYSTEM log files during intrusions.