Quick links
Press Enter to search, Esc to close
Threat group profile
The US, UK, EU and Estonian governments attribute this activity to GRU Unit 29155, a Russian military intelligence unit, and MITRE tracks it as Ember Bear.
In short
The US, UK, EU and Estonian governments attribute this activity to GRU Unit 29155, a Russian military intelligence unit, and MITRE tracks it as Ember Bear. It is described as using public tools and flaws in internet-facing systems to spy, leak data and wipe data, with a focus on Ukraine and those who aid it.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| Ember Bear | MITRE ATT&CK G1003 (group name)[1] |
| Cadet Blizzard | MITRE Associated Groups; US advisory of 5 September 2024; UK profile (cyber wing of Unit 29155); EU Implementing Regulation 2025/2568[1, 2, 10, 11] |
| UAC-0056 | MITRE Associated Groups; US advisory of 5 September 2024[1, 2] |
| UNC2589 | MITRE Associated Groups; US advisory of 5 September 2024[1, 2] |
| Bleeding Bear | MITRE Associated Groups; US advisory of 5 September 2024[1, 2] |
| DEV-0586 | MITRE Associated Groups; US advisory of 5 September 2024[1, 2] |
| Frozenvista | MITRE Associated Groups; US advisory of 5 September 2024[1, 2] |
| STORM-0587 | Listed as an associated organization on the Rewards for Justice page[6] |
| STORM-0711 | Listed as an associated organization on the Rewards for Justice page[6] |
| GRU Unit 29155 (161st Specialist Training Center, TsPS) | The unit named by MITRE, the US, the UK, the EU and Estonia[1, 2, 3, 4, 8, 11] |
| Saint Bear | Not an alias. MITRE says it is a distinct actor[1] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
MITRE ATT&CK Page version 2.1, last modified 31 July 2026
Describes Ember Bear as a Russian state-sponsored cyber espionage group, linked to GRU Unit 29155 and active since at least 2020. Says it conducted the WhisperGate wiper attacks against Ukraine in early 2022.[1]
UK and allies (NCSC and partners) May 2022
Attributed use of the WhisperGate wiper in Ukraine to Russia's military intelligence service.[3]
US FBI, CISA and NSA with partner agencies 5 September 2024
Assess that cyber actors affiliated with GRU Unit 29155 are responsible for operations for espionage, sabotage and reputational harm since at least 2020, and attribute the WhisperGate deployment to the unit.[2]
UK NCSC 5 September 2024
Said it was the first time the UK had publicly exposed Unit 29155 for malicious cyber activity, which it assessed had run since at least 2020.[3]
Estonia (Foreign Ministry) 5 September 2024
Attributed the 2020 cyberattacks on Estonia to members of Unit 29155. Said this was the first time Estonia had attributed attacks against the state to the people behind them.[4]
Estonia (Prosecutor's Office) 5 September 2024
Named three GRU officers as suspects (Yuri Denisov, Nikolay Korchagin, Vitali Shevchenko) and said they were declared international fugitives.[5]
US FBI and US District Court, District of Maryland 7 August 2024 (warrants)
Notice says six people allegedly conspired on behalf of GRU Unit 29155 between December 2020 and August 2024. Arrest warrants issued for conspiracy to commit computer intrusion and damage, and wire fraud conspiracy.[7]
US State Department (Rewards for Justice) Page not dated
Names five of them as Russian military intelligence officers with Unit 29155 and offers up to 10 million dollars for information.[6]
UK Foreign Office 18 July 2025
Sanctioned Unit 29155 and named Borovkov, Korchagin, Denisov and Shevchenko in a list of those sanctioned.[8]
UK NCSC 18 July 2025
Said the UK had exposed Unit 29155 for carrying out digital sabotage attacks.[9]
UK Government (profile of GRU cyber operations) 2026, exact date not stated
Describes Cadet Blizzard as the cyber wing of Unit 29155 and says the unit deployed the WhisperGate wiper on over 70 Ukrainian government systems.[10]
EU Council 15 December 2025
Listed Borovkov, Denisenko and Goloshubov as members of GRU Unit 29155 and of cyber actor Cadet Blizzard, for cyber attacks on Ukrainian government bodies.[11, 12]
The sources use different labels. MITRE and the US advisory treat Ember Bear and Cadet Blizzard as names for one cluster tied to Unit 29155. The UK profile calls Cadet Blizzard a cyber wing of Unit 29155. The EU text names both the unit and "cyber actor Cadet Blizzard" and does not say they are the same thing. The US advisory warns that company tracking names may not match the US Government's own view of the activity.
MITRE lists exploitation of CVE-2021-26084 in Confluence servers. The US advisory says its actors obtained exploit scripts for CVE-2021-26084 but were not seen exploiting it, and lists CVE-2022-26134 and CVE-2022-26138 as exploited. Sources differ.
MITRE says Saint Bear is a distinct actor. The Rewards for Justice page lists no such name, and the US advisory does not mention Saint Bear. MITRE also notes Ember Bear has used the Saint Bot downloader.
Sources differ on purpose. MITRE calls the group a cyber espionage group. The US advisory lists espionage, sabotage and reputational harm. The EU and UK describe sabotage and destructive attacks.
Each entry is attributed to the group by the sources cited.
The US advisory says Unit 29155 added offensive cyber operations to its work since at least 2020.[2]
The US advisory says the unit began deploying the wiper against Ukrainian victims as early as this date.[2]
CISA says the malware was announced on this date by a security company. It corrupts the boot record and shows a fake ransom note, but the data is destroyed.[13]
CISA and the FBI issued AA22-057A. It describes WhisperGate and does not name a group.[13]
The US advisory says the primary focus since early 2022 appears to be disrupting efforts to provide aid to Ukraine.[2]
The NCSC says the UK and allies attributed the wiper to Russia's military intelligence service.[3]
Warrants were issued in Maryland for six people.[7]
The UK sanctioned Unit 29155 and named officers.[8]
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| 26 February 2022 | CISA and FBI | Joint advisoryAA22-057A on destructive malware in Ukraine, including WhisperGate. It does not name a group.[13] |
| May 2022 | UK and allies | Public attributionAttributed WhisperGate use in Ukraine to Russia's military intelligence service.[3] |
| 7 August 2024 | US District Court, District of Maryland (FBI notice) | Arrest warrantsSix people charged with conspiracy to commit computer intrusion and damage, and wire fraud conspiracy.[7] |
| Not dated on the page | US State Department (Rewards for Justice) | Reward offerUp to 10 million dollars for information on the individuals.[6] |
| 5 September 2024 | FBI, CISA, NSA and partner agencies | Joint advisoryAttributed operations since at least 2020 and the WhisperGate deployment to Unit 29155.[2] |
| 5 September 2024 | Estonia | Attribution and arrest ordersAttributed the 2020 attacks to Unit 29155. The Harju District Court ordered three suspects held in their absence.[4, 5] |
| 5 September 2024 | UK NCSC | Public attributionFirst UK public exposure of Unit 29155 for malicious cyber activity.[3] |
| 18 July 2025 | UK Foreign Office | SanctionsSanctioned Unit 29155 and named officers.[8] |
| 15 December 2025 | EU Council | Sanctions listingsListed Borovkov, Denisenko and Goloshubov.[11, 12] |
Techniques reported for this group, by MITRE ATT&CK tactic.
Acquire Infrastructure: Virtual Private Server T1583.003
The US advisory says the actors have used rented servers since at least 2020 to host tools and take data.[1, 2]
Obtain Capabilities: Exploits T1588.005
The US advisory says the actors take exploit scripts for known flaws from public code sites.[1, 2]
Exploit Public-Facing Application T1190
The US advisory says the actors try to exploit flaws in internet-facing systems to get in.[1, 2]
Valid Accounts: Default Accounts T1078.001
The US advisory says the actors logged in to IP cameras with default usernames and passwords.[1, 2]
Supply Chain Compromise T1195
MITRE says the group has compromised IT providers and software developers to reach their customers.[1]
WhisperGate Wiper malware
MITRE describes a multi-stage wiper designed to look like ransomware, used against Ukrainian organizations since at least January 2022.[1, 14]
Rclone Data copy tool
MITRE and the US advisory say it was used to copy stolen data to cloud storage.[1, 2, 16]
Impacket Network attack toolkit
The US advisory says it was used for post-exploitation and moving between systems.[1, 2]
BloodHound Directory mapping tool
MITRE says the group used it to map Active Directory.[1]
CrackMapExec Network attack tool
MITRE says the group used it during intrusions.[1]
P.A.S. Webshell Web shell
MITRE and the US advisory say the actors used this web shell.[1, 2]
reGeorg Web shell and tunnel
MITRE lists it among web shells used by the group.[1]
Saint Bot Downloader
MITRE says Ember Bear used it but is distinct from the actor Saint Bear.[1, 15]
Raspberry Robin Malware loader
The US advisory says it may have been used as an access broker.[2]
A customer can see which of their internet-facing systems are exposed, which is where the US advisory says this unit looks for a way in.
A customer can follow government reporting on this unit and its alias names in one place.
A customer can watch for their data being offered or released, which the US advisory says these actors do.
A customer can bring these alerts together and track what to fix first.
MITRE ATT&CK uses this name for a cluster it links to GRU Unit 29155, a Russian military intelligence unit. The US, UK and partner agencies attributed the unit's cyber operations on 5 September 2024.
The US advisory says the unit began deploying the WhisperGate wiper against Ukrainian victims as early as 13 January 2022. The UK profile says it hit over 70 Ukrainian government systems.
The US advisory and MITRE treat Cadet Blizzard as another name for the same cluster. MITRE says Saint Bear is a different actor.
No. The US and UK say Unit 29155 is separate from Unit 26165 (APT28) and Unit 74455 (Sandworm).
The FBI notice lists six people charged in the US, and the State Department offers up to 10 million dollars. The UK sanctioned the unit in July 2025. The EU listed three people in December 2025.
The US advisory says to patch known exploited flaws, use phishing-resistant multi-factor authentication on webmail and VPN, and limit exposed services.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.