ENERGETIC BEARThreat actor
- allanite
- atk6
- Berserk Bear
- blue kraken
- bromine
- crouching yeti
- dragonfly
- dymalloy
- g0035
- ghost blizzard
- group 24
- havex
- iron liberty
- itg15
- koala team
- palmetto fusion
- temp.isotope
- tg-4192
A Russian group that collects intelligence on the energy industry.From MISP Galaxy
Last reported 3 days ago, by SecurityWeek2 reports
ATT&CK techniques
6 of 7 · each with the sentence it comes from- T1053Scheduled Task/Job
“| Execution | Scheduled Task/Job | T1053.005 |”
- T1053.005Scheduled Task
“| Execution | Scheduled Task/Job | T1053.005 |”
- T1222File and Directory Permissions Modification
“| Defense Evasion | File and Directory Permissions Modification | T1222 |”
- T1485Data Destruction
“| Impact | Data Destruction | T1485 |”
- T1529System Shutdown/Reboot
“| Impact | System Shutdown/Reboot | T1529 |”
- T1552.004Private Keys
“Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7“Noteworthy examples include ENERGETIC BEAR, Void Blizzard, and Sandworm which are all Russia linked.”
-
DYNOWIPER: Destructive Malware Targeting Poland's Energy Sector“CERT Polska attributes the attack infrastructure to the threat cluster Cisco refers to as Static Tundra, Crowdstrike refers to as Berserk Bear, Microsoft calls Ghost Blizzard, and Symantec labels as Dragonfly”
Indicators in its reports
named in the reports above- 31.172.71[.]5in 1 report
- 4ec3c90846af6b79…3fd21f6d4cf6in 1 report
- 835b0d87ed2d4989…088dcede68d5in 1 report
- a727362416834fa63672b87820ff7f27in 1 report
- 65099f306d27c8bc…b238210f0f7cin 1 report
- 60c70cdcb1e998bf…e77c411cae4bin 1 report
- d1389a1ff652f8ca…adb201242160in 1 report
- 8759e79cf3341406…6fce8539cf15in 1 report
- f4e9a3ddb83c53f5…a793f65ffaeein 1 report
- 185.200.177[.]10in 1 report
- 193.200.17[.]163in 1 report
- 185.82.127[.]20in 1 report
- 72.62.35[.]76in 1 report
Copy these 13 indicators · defanged
Thanks — we review every report.