Ember Bear

Ember Bear has used WMI execution with password hashes for command execution and lateral movement.^[1]

Ember Bear gathers victim system information such as enumerating the volume of a given device or extracting system and security event logs for analysis.^[2][1]

Ember Bear has renamed the legitimate Sysinternals tool procdump to alternative names such as dump64.exe to evade detection.^[2]

Ember Bear has compromised information technology providers and software developers providing services to targets of interest, building initial access to ultimate victims at least in part through compromise of service providers that work with the victim organizations.^[2]

Ember Bear modifies registry values for anti-forensics and defense evasion purposes.^[2]

Ember Bear gains initial access to victim environments by exploiting external-facing services. Examples include exploitation of CVE-2021-26084 in Confluence servers; CVE-2022-41040, ProxyShell, and other vulnerabilities in Microsoft Exchange; and multiple vulnerabilities in open-source platforms such as content management systems.^[2][1]

Ember Bear has used ProxyChains to tunnel protocols to internal networks.^[1]

Ember Bear have used VPNs both for initial access to victim environments and for persistence within them following compromise.^[1]

Ember Bear has used exploits to enable follow-on execution of frameworks such as Meterpreter.^[1]

Ember Bear has created accounts on dark web forums to obtain various tools and malware.^[1]

Ember Bear has compressed collected data prior to exfiltration.^[1]

Ember Bear gathers credential material from target systems, such as SSH keys, to facilitate access to victim environments.^[2]

Ember Bear has enumerated SECURITY and SYSTEM log files during intrusions.^[1]

Ember Bear used the su-bruteforce tool to brute force specific users using the su command.^[1]

Ember Bear retrieves follow-on payloads direct from adversary-owned infrastructure for deployment on compromised hosts.^[2]

Ember Bear attempts to collect mail from accessed systems and servers.^[2][1]

Ember Bear has used tools such as NMAP for remote system discovery and enumeration in victim environments.^[1]

Ember Bear engages in mass collection from compromised systems during intrusions.^[2]

Ember Bear uses services such as IVPN, SurfShark, and Tor to add anonymization to operations.^[2]

Ember Bear has exfiltrated images from compromised IP cameras.^[1]

Ember Bear uses valid network credentials gathered through credential harvesting to move laterally within victim networks, often employing the Impacket framework to do so.^[2]

Ember Bear has used exploits for vulnerabilities such as MS17-010, also known as Eternal Blue, during operations.^[1]

Ember Bear has used tools such as Nmap and MASSCAN for remote service discovery.^[1]

Ember Bear uses socket-based tunneling utilities for command and control purposes such as NetCat and Go Simple Tunnel (GOST). These tunnels are used to push interactive command prompts over the created sockets.^[2] Ember Bear has also used reverse TCP connections from Meterpreter installations to communicate back with C2 infrastructure.^[1]

Ember Bear has used various non-standard ports for C2 communication.^[1]