FlagThis
← Threat Actors / Russia / ENERGETIC BEAR
DOSSIER // ENERGETIC-BEAR

ENERGETIC BEAR

▲ High Threat Russia
Primary Aliases: BERSERK BEAR Ghost Blizzard Static Bear ALLANITE
Sponsor / State Affiliation Russian Federation
Primary Motivation Espionage
Confidence Rating 70% (Grounded)

A Russian group that collects intelligence on the energy industry.

📥 Export ATT&CK Layer (.json) 🔔 RSS Feed 🏛️ CISA Advisories ↗

🎯 Target Sectors & Focus

Private sector Government Energy

🛡️ MITRE ATT&CK® Attack Lifecycle (56 TTPs)

📥 Download Navigator JSON
Initial Access 8
T1566 Valid Accounts
↗
T1566 Drive-by Target
↗
T1566 Spearphishing Attachment
↗
T1566 Drive-by Compromise
↗
T1566 Compromise Software Supply Chain
↗
T1566 Spearphishing Link
↗
T1566 External Remote Services
↗
T1566 Exploit Public-Facing Application
↗
Execution 6
T1059 Exploitation for Client Execution
↗
T1059 Command and Scripting Interpreter
↗
T1059 Windows Command Shell
↗
T1059 Scheduled Task
↗
T1059 PowerShell
↗
T1059 Python
↗
Persistence & Privilege Escalation 4
T1547 Web Shell
↗
T1547 Query Registry
↗
T1547 Modify Registry
↗
T1547 Registry Run Keys / Startup Folder
↗
Credential Access & Discovery 6
T1003 System Network Configuration Discovery
↗
T1003 File and Directory Discovery
↗
T1003 Network Share Discovery
↗
T1003 Brute Force
↗
T1003 System Owner/User Discovery
↗
T1003 Remote System Discovery
↗
Lateral Movement & Collection 4
T1021 Screen Capture
↗
T1021 Remote Email Collection
↗
T1021 Remote Desktop Protocol
↗
T1021 Local Data Staging
↗
Command & Control 1
T1071 Ingress Tool Transfer
↗
Operational Techniques 26
T1000 Archive Collected Data
↗
T1000 Hidden Users
↗
T1000 Malicious File
↗
T1000 Business Relationships
↗
T1000 Server
↗
T1000 Local Account
↗
T1000 Template Injection
↗
T1000 Password Cracking
↗
T1000 Domains
↗
T1000 Security Account Manager
↗
T1000 Data from Local System
↗
T1000 File Deletion
↗
T1000 Clear Windows Event Logs
↗
T1000 Disable or Modify System Firewall
↗
T1000 Tool
↗
T1000 Masquerade Account Name
↗
T1000 NTDS
↗
T1000 Additional Local or Domain Groups
↗
T1000 Virtual Private Server
↗
T1000 File Transfer Protocols
↗
T1000 Domain Groups
↗
T1000 Vulnerability Scanning
↗
T1000 LSA Secrets
↗
T1000 Forced Authentication
↗
T1000 Exploitation of Remote Services
↗
T1000 Domain Account
↗
Copied to clipboard
LINK COPIED TO CLIPBOARD