Threat Intelligence Tarot
Vol. II · 128
Russia
★★★★★
risk 4/5
✦ The Ember Before the Fire ✦
Ember Bear
UAC-0056 · Saint Bear · Bleeding Bear · Lorec53 · Nodaria
Ukrainian governmentUkrainian critical infrastructureEastern European NATO members
Active since ~2020 · Disruption, Pre-positioning, Ukraine-focused espionage
The Ember Before the Fire glowed quietly in the days before February 24, 2022 — a small light that meant nothing until the night it became everything. Its operators measured success in what would later be ash.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆WhisperGate wiper deployment against Ukraine (January 2022)
- ◆Pre-invasion staging of destructive payloads
- ◆GraphSteel and GrimPlant credential harvesters
- ◆Continued targeting of Ukrainian government and CERT-UA tracking
Defenses
- ▸Off-region backup with immutable storage and tested restoreCIS Control 11 ↗
- ▸Wiper-aware EDR detection rules covering MBR overwrite and disk wipingMITRE D3FEND
- ▸Critical infrastructure network segmentation from corporate networksNIST SP 800-82 ↗
- ▸Geopolitical risk integration into security operations postureNIST CSF: ID.RA ↗
Reversed: Their Weakness
CERT-UA's public IOC sharing and Ukraine's distributed cloud backup strategy (Operation Backup Ukraine) demonstrate that pre-positioned wipers can be neutralized through pre-positioned resilience.
Share this adversary profile
Compare →swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.