Threat Actor Profile
Ember Bear
Emerging in 2021, Ember Bear—commonly recognized as UAC-0056 or Lorec53—is a Russian state-sponsored cyber espionage group closely tied to the GRU. Known for spear-phishing and wiper malware like WhisperGate, they target critical infrastructure, governments, and defense sectors, often leveraging destructive tactics alongside data theft.
Threat Actor Profile
Ember Bear
Country of Origin
Members
Leadership
Ember Bear TTPs
Tactics
The group primarily focuses on espionage and long-term intelligence gathering but has demonstrated capability for wiper attacks targeting Ukrainian entities.
Techniques
Their tools and methods include spearphishing with malicious documents, persistence through web shells, and exploitation of remote access tools for lateral movement.
Procedures
Notable procedures include deploying tools like WhisperGate wiper malware, document stealers such as OutSteel, and backdoor malware like GraphSteel and GrimPlant.
Want to Shut Down Threats Before They Start?
Notable Cyberattacks
WhisperGate Wiper (2022)
Ukrainian Website Compromise (2021–2022)
Law Enforcement & Arrests
To date, there have been no public reports of successful arrests or law enforcement actions specifically dismantling Ember Bear’s operations.
How to Defend Against Ember Bear
Organizations should employ robust email security measures to block phishing attempts, monitor web servers for unusual activity, and use endpoint detection tools to detect malicious processes.
Effective network monitoring and regular patching of systems are vital for mitigating threats from Ember Bear.
References
Detect, Respond, Protect
See how the global Huntress SOC can augment your team
with 24/7 coverage and unmatched human expertise.
Start your free trial today.
