Ember Bear

ACTIVE CAMPAIGN TRACKED ▲ High Threat Russia

Primary Aliases: Bleeding Bear Cadet Blizzard DEV-0586 DEV-0587

Sponsor / State Affiliation Russia (GRU)

Primary Motivation Strategic espionage and geopolitical intelligence gathering

Confidence Rating 92% (Grounded)

European Political and NGO Espionage, Strategic Intelligence Collection via OAuth Abuse

🎯 Target Sectors & Focus

Governmental agencies Diplomatic entities Non-governmental organizations (NGOs) Think tanks Political parties Media organizations Defense contractors

🛡️ MITRE ATT&CK® Attack Lifecycle (7 TTPs)

📥 Download Navigator JSON

Initial Access 1

T1566 Spear-phishing

Execution 1

T1059 Living-off-the-land (LotL)

Credential Access & Discovery 1

T1003 Credential harvesting via spoofed login pages

Command & Control 1

T1071 Custom malware deployment

Operational Techniques 3

T1000 OAuth application abuse

T1000 Cloud service exploitation (Microsoft 365)

T1000 Use of deceptive URLs

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

[DEEP DIVE] Star Blizzard Scales Phishing Operations with RedFlick Malware Delivery

Strategies and Tactics 2026-10-03

Copied to clipboard

LINK COPIED TO CLIPBOARD