G1003: Ember Bear

Ember Bear has used tools such as Nmap and MASSCAN for remote service discovery.[1]

Ember Bear gathers credential material from target systems, such as SSH keys, to facilitate access to victim environments.[2]

Ember Bear has configured multi-hop proxies via ProxyChains within victim environments.[1]

Ember Bear attempts to collect mail from accessed systems and servers.[2][1]

Ember Bear uses services such as IVPN, SurfShark, and Tor to add anonymization to operations.[2]

Ember Bear has compressed collected data prior to exfiltration.[1]

Ember Bear has renamed the legitimate Sysinternals tool procdump to alternative names such as dump64.exe to evade detection.[2]

Ember Bear has used publicly available tools such as MASSCAN and Acunetix for vulnerability scanning of public-facing infrastructure.[1]

Ember Bear has used virtual private servers (VPSs) to host tools, perform reconnaissance, exploit victim infrastructure, and as a destination for data exfiltration.[1]

Ember Bear has enumerated SECURITY and SYSTEM log files during intrusions.[1]

Ember Bear gains initial access to victim environments by exploiting external-facing services. Examples include exploitation of CVE-2021-26084 in Confluence servers; CVE-2022-41040, ProxyShell, and other vulnerabilities in Microsoft Exchange; and multiple vulnerabilities in open-source platforms such as content management systems.[2][1]

Ember Bear have used VPNs both for initial access to victim environments and for persistence within them following compromise.[1]

Ember Bear engages in mass collection from compromised systems during intrusions.[2]

Ember Bear has used various non-standard ports for C2 communication.[1]

Ember Bear deletes files related to lateral movement to avoid detection.[2]

Ember Bear retrieves follow-on payloads direct from adversary-owned infrastructure for deployment on compromised hosts.[2]

Ember Bear uses socket-based tunneling utilities for command and control purposes such as NetCat and Go Simple Tunnel (GOST). These tunnels are used to push interactive command prompts over the created sockets.[2] Ember Bear has also used reverse TCP connections from Meterpreter installations to communicate back with C2 infrastructure.[1]

Ember Bear has exfiltrated images from compromised IP cameras.[1]

Ember Bear has used ProxyChains to tunnel protocols to internal networks.[1]

Ember Bear used the `su-bruteforce` tool to brute force specific users using the `su` command.[1]

Ember Bear has acquired malware and related tools from dark web forums.[1]

Ember Bear has conducted password spraying against Outlook Web Access (OWA) infrastructure to identify valid user names and passwords.[1]

Ember Bear has targeted IP ranges for vulnerability scanning related to government and critical infrastructure organizations.[1]

Ember Bear deploys web shells following initial access for either follow-on command execution or protocol tunneling. Example web shells used by Ember Bear include P0wnyshell, reGeorg, P.A.S. Webshell, and custom variants of publicly-available web shell examples.[2][1]

Ember Bear has created accounts on dark web forums to obtain various tools and malware.[1]

Ember Bear is linked to the defacement of several Ukrainian organization websites.[2]

Ember Bear uses remotely scheduled tasks to facilitate remote command execution on victim machines.[2]

Ember Bear has used exploits for vulnerabilities such as MS17-010, also known as `Eternal Blue`, during operations.[1]

Ember Bear has used PowerShell commands to gather information from compromised systems, such as email servers.[1]

Ember Bear modifies registry values for anti-forensics and defense evasion purposes.[2]

Ember Bear has used DNS tunnelling tools, such as dnscat/2 and Iodine, for C2 purposes.[1]

Ember Bear has used pass-the-hash techniques for lateral movement in victim environments.[1]

Ember Bear has used tools such as Rclone to exfiltrate information from victim environments to cloud storage such as `mega.nz`.[1]

Ember Bear has obtained exploitation scripts against publicly-disclosed vulnerabilities from public repositories.[1]

Ember Bear has compromised information technology providers and software developers providing services to targets of interest, building initial access to ultimate victims at least in part through compromise of service providers that work with the victim organizations.[2]

Ember Bear gathers victim system information such as enumerating the volume of a given device or extracting system and security event logs for analysis.[2][1]

Ember Bear conducted destructive operations against victims, including disk structure wiping, via the WhisperGate malware in Ukraine.[2]

Ember Bear has used exploits to enable follow-on execution of frameworks such as Meterpreter.[1]

Ember Bear has renamed tools to match legitimate utilities, such as renaming GOST tunneling instances to `java` in victim environments.[1]

Ember Bear has dumped configuration settings in accessed IP cameras including plaintext credentials.[1]

Ember Bear uses legitimate Sysinternals tools such as procdump to dump LSASS memory.[2][1]

Ember Bear has used WMI execution with password hashes for command execution and lateral movement.[1]

Ember Bear uses valid network credentials gathered through credential harvesting to move laterally within victim networks, often employing the Impacket framework to do so.[2]

Ember Bear has used frameworks such as Impacket to dump LSA secrets for credential capture.[1]

Ember Bear acquires victim credentials by extracting registry hives such as the Security Account Manager through commands such as reg save.[2][1]

Ember Bear has abused default user names and passwords in externally-accessible IP cameras for initial access.[1]

Ember Bear has used tools such as NMAP for remote system discovery and enumeration in victim environments.[1]