RussiaAttributedGRU Unit 29155DestructiveActive 2020 – 2023Cadet Blizzard
Also known asEmber Bear · UNC2589 · DEV-0586 · Bleeding Bear · Nascent Ursa · Frozen Vista
Summary
GRU 161st Specialist Training Center (military unit 29155) — Microsoft's Cadet Blizzard, CrowdStrike's Ember Bear (MITRE G1003). Ran the WhisperGate wiper attacks on Ukrainian government networks on 13 Jan 2022, ahead of the invasion, then defacements and the 'Free Civilian' hack-and-leak persona. Exploits internet-facing services (Confluence, Exchange ProxyNotShell, Dahua cameras, Sophos firewalls) and has scanned infrastructure in at least 26 NATO countries (AA24-249A). On 5 Sep 2024 the US charged five unit 29155 officers and a civilian co-conspirator, with a $10M Rewards for Justice offer. Latest confirmed intrusion activity is 2023 (Microsoft); later government actions are undated. Often confused with Saint Bear (UAC-0056/Lorec53), which MITRE tracks as a distinct cluster.
Attribution
The advisory notes vendor names may not map one-to-one
Named by a government: indictment, sanctions designation, joint advisory or official statement.
- FBI, NSA, CISA and partners (AA24-249A) (Government, 2024-09-05)
Joint advisory: GRU 161st Specialist Training Center (Unit 29155); lists Cadet Blizzard and Ember Bear - MITRE ATT&CK (MITRE ATT&CK, 2026-10)
Linked to GRU 161st Specialist Training Center (Unit 29155)
Campaigns 2
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| 2023 re-emergence — defacements and 'Free Civilian' hack-and-leak | 2023-01 – 2023-06 | Ukraine, Europe | Government, IT | Microsoft Threat Intelligence (2023-06-14) |
| WhisperGate destructive attacks on Ukrainian government | 2022-01 | Ukraine | Government | Microsoft Threat Intelligence (2023-06-14); AA24-249A |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 10
| Reconnaissance1 | T1595.001Scanning IP Blocks |
|---|---|
| Resource Development1 | T1588.005Exploits |
| Initial Access2 | T1190Exploit Public-Facing ApplicationT1195Supply Chain Compromise |
| Execution1 | T1059.001PowerShell |
| Stealth1 | T1078.001Default Accounts |
| Lateral Movement1 | T1021Remote Services |
| Impact3 | T1485Data DestructionT1561Disk WipeT1491.002External Defacement |
Malware and tools 4
| Name | Description | Platform |
|---|---|---|
| WhisperGate | Multi-stage Wiper | Windows |
| POEMGATE | Credential Harvester | Windows |
| P.A.S. Webshell | Malware | Linux/Windows |
| Saint Bot | Malware | Windows |
Exploited vulnerabilities 6
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2021-26084 | 9.8 | Atlassian Confluence — OGNL injection (KEV 2021-11-03) |
| CVE-2021-33044 | 9.8 | Dahua IP camera — authentication bypass (KEV 2024-08-21) |
| CVE-2021-33045 | 9.8 | Dahua IP camera — authentication bypass (KEV 2024-08-21) |
| CVE-2022-26134 | 9.8 | Atlassian Confluence — OGNL injection RCE (KEV 2022-06-02) |
| CVE-2022-26138 | 9.8 | Atlassian Questions for Confluence — hard-coded credentials (KEV 2022-07-29) |
| CVE-2022-41040 | 8.8 | Microsoft Exchange — SSRF (ProxyNotShell) (KEV 2022-09-30) |
Highest CVSS first.
Infrastructure patterns
- IVPN, SurfShark and Tor for anonymity; NetCat and GOST tunnel C2 (Microsoft, 2023; MITRE ATT&CK, 2026)
- Leaks on a Tor .onion site and, from 2023, the "Free Civilian" Telegram channel (Microsoft, 2023)
- DNS-tunnelling tools (dnscat2, Iodine) for C2; Rclone exfiltration to mega.nz (MITRE ATT&CK, 2026)
Reporting and advisories 5
- CISA
AA22-057A — Destructive Malware Ukraine - Microsoft Threat Intelligence
2023 re-emergence — defacements and 'Free Civilian' hack-and-leak - MITRE ATT&CK
Cadet Blizzard (G1003) group profile - US DOJ (D. Md.)
Five Russian GRU officers and one civilian charged for conspiring to hack Ukrainian government (Sep 2024) - FBI / NSA / CISA et al.
AA24-249A: Russian military cyber actors target US and global critical infrastructure