ENERGETIC BEAR — Threat Actors — SecurityStudies.info

News fetched Nov 13, 00:01 UTC

Profile

Also known as: ALLANITE, ATK6, BERSERK BEAR, Blue Kraken, BROMINE, CASTLE, Crouching Yeti, Dragonfly, DYMALLOY, G0035, Ghost Blizzard, Group 24, Havex, IRON LIBERTY, ITG15, Koala Team, TEMP.Isotope, TG-4192

A Russian group that collects intelligence on the energy industry.

ATT&CK techniques · 56

Reconnaissance

T1591.002Business Relationships T1595.002Vulnerability Scanning T1598.002Spearphishing Attachment T1598.003Spearphishing Link

Resource Development

T1583.001Domains T1583.003Virtual Private Server T1584.004Server T1588.002Tool T1608.004Drive-by Target

Initial Access

T1078Valid Accounts T1133External Remote Services T1189Drive-by Compromise T1190Exploit Public-Facing Application T1195.002Compromise Software Supply Chain T1566.001Spearphishing Attachment

Execution

T1053.005Scheduled Task T1059Command and Scripting Interpreter T1059.001PowerShell T1059.003Windows Command Shell T1059.006Python T1203Exploitation for Client Execution T1204.002Malicious File

Persistence

T1098.007Additional Local or Domain Groups T1112Modify Registry T1136.001Local Account T1505.003Web Shell T1547.001Registry Run Keys / Startup Folder

Stealth

T1036.010Masquerade Account Name T1070.004File Deletion T1221Template Injection T1564.002Hidden Users

Defense Impairment

T1685.005Clear Windows Event Logs T1686Disable or Modify System Firewall

Credential Access

T1003.002Security Account Manager T1003.003NTDS T1003.004LSA Secrets T1110Brute Force T1110.002Password Cracking T1187Forced Authentication

Discovery

T1012Query Registry T1016System Network Configuration Discovery T1018Remote System Discovery T1033System Owner/User Discovery T1069.002Domain Groups T1083File and Directory Discovery T1087.002Domain Account T1135Network Share Discovery

Lateral Movement

T1021.001Remote Desktop Protocol T1210Exploitation of Remote Services

Collection

T1005Data from Local System T1074.001Local Data Staging T1113Screen Capture T1114.002Remote Email Collection T1560Archive Collected Data

Command and Control

T1071.002File Transfer Protocols T1105Ingress Tool Transfer

Incidents attributed

No incident in the register is attributed to this actor.

In the news

No Asia-Pacific article names this actor yet.

Targets

China

Japan

Elsewhere: Germany, Spain, France, Ireland, Italy, Poland, Türkiye, United States

Sectors: Energy, Government, Private sector

Relevance to the EU

EU relevance: High

Targets EU member states (Germany, Spain, France, Ireland and 2 more) as well as 2 Asia-Pacific countries

10 EU cooperation projects in the Asia-Pacific countries this actor targets:

Trade & Investment

Research & Innovation

Peace & Security

Education & Skills

Development Cooperation

Threats to the EU →

References

Sources: MISP, MITRE

csrftoken	CSRF protection — prevents cross-site request forgery attacks	1 year	Essential
sessionid	Session management — keeps authenticated users logged in	14 days	Essential