{"actor":{"id":"ember-bear","name":"Ember Bear","aliases":["Cadet Blizzard","Bleeding Bear","Saint Bear","Lorec53","UAC-0056"],"vendor_names":{"microsoft":"DEV-0586","crowdstrike":"Ember Bear","mandiant":"UNC2589","mitre":"G1003"},"mitre_gid":"G1003","type":"nation-state","type_verbatim":"nation-state APT","secondary_types":[],"origin":"RU","origins":["RU"],"targets":["AT","AU","BE","DE","DK","FR","GB","GE","IN","LT","LV","MY","PL","SA","UA","US"],"target_regions":[],"sectors":["def","gov"],"threat_types":["dis","esp"],"mitre_techniques":["T1003","T1003.001","T1003.002","T1003.004","T1005","T1018","T1021","T1027.002","T1036","T1036.005","T1046","T1047","T1053.005","T1059","T1059.001","T1059.003","T1059.007","T1070.004","T1071.004","T1090.003","T1095","T1110","T1112","T1119","T1125","T1190","T1195","T1203","T1204.001","T1210","T1497","T1550.002","T1552.001","T1560","T1561.002","T1566.001","T1567.002","T1570","T1571","T1583","T1583.003","T1583.006","T1585","T1589.002","T1654","T1684.001","T1685"],"gir_codes":[],"active_since":2020,"brief":"GRU cluster responsible for WhisperGate wiper attacks on Ukraine.","attribution_sponsor":null,"attribution_confidence":null,"merged_into":null,"split_from":[],"created_at":"2026-05-20T09:52:20.775776+00:00","updated_at":"2026-07-29T07:05:54.598+00:00","url":"https://aptatlas.net/actors/ember-bear"},"exports":{"stix":"https://aptatlas.net/api/v1/actors/ember-bear/stix","navigator":"https://aptatlas.net/api/v1/actors/ember-bear/navigator"}}