Skip to content
skopnix
← Adversaries

File · DEV-0586 · Nation-state · assessed origin Russia · refreshed 2026-10-18

DEV-0586

  • Ruinous Ursa
  • Cadet Blizzard
  • UNC2589
  • Bleeding Bear
  • Frozenvista
  • UAC-0056

state sponsor · Russian FederationMITRE G1003 ↗

DEV-0586 — ATT&CK roseDE

attack rose · 47 techniques across 14 tactics

Analyst brief

MSTIC has not found any notable associations between this observed activity, tracked as DEV-0586, and other known activity groups. MSTIC assesses that the malware (WhisperGate), which is designed to look like ransomware but lacking a ransom recovery mechanism, is intended to be destructive and designed to render targeted devices inoperable rather than to obtain a ransom.

Observed targets (as stated by the sources)

1 countries · 0 sectors
UkraineAssessed origin: Russia

assessed origin · Russiaobserved targets · 1

countries · 1

  • Ukraine

as stated by the cited sources, not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

47 techniques · 14 of 15 tactics

  1. Reconnaissance

    2 techniques

  2. Resource development

    5 techniques

  3. Initial access

    2 techniques

  4. Execution

    4 techniques

  5. Persistence

    2 techniques

  6. Stealth

    4 techniques

  7. Defense impairment

    1 technique

  8. Credential access

    7 techniques

  9. Discovery

    3 techniques

  10. Lateral movement

    4 techniques

  11. Collection

    5 techniques

  12. Command and control

    5 techniques

  13. Exfiltration

    1 technique

  14. Impact

    2 techniques

select a technique

Arsenal

4 malware · 7 tools
Malware
Malware · 4ATT&CK
P.A.S. WebshellS0598 ↗
reGeorgS1187 ↗
WhisperGateS0689 ↗
Saint BotS1018 ↗
Tools
Tools · 7ATT&CK
CrackMapExecS0488 ↗
ResponderS0174 ↗
ngrokS0508 ↗
PsExecS0029 ↗
RcloneS1040 ↗
BloodHoundS0521 ↗
ImpacketS0357 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Detections

9 rules · Sigma · QRadar · Cortex

  1. Behaviour (ATT&CK technique)

    LSASS memory dump via comsvcs.dll MiniDump (T1003.001)

    APT1 · APT15 · APT27 · APT28 · APT3 · APT32 · 39 more

    T1003.001conf 90SIGAQLXQL

  2. Behaviour (ATT&CK technique)

    PowerShell download cradle executed from the command line (T1059.001)

    APT-C-36 · APT10 · APT19 · APT27 · APT28 · APT29 · 81 more

    T1059.001conf 80SIGAQLXQL

  3. Behaviour (ATT&CK technique)

    rclone copy or sync to remote storage (T1567.002)

    APT27 · APT31 · APT40 · BRONZE STARLIGHT · Chimera · Confucius · 19 more

    T1567.002conf 70SIGAQLXQL

Generated by skopnix from this finding, each with false-positive notes. Open the list →

Primary-source reports

linked, never re-hosted
  1. 2022Cyber attack of UAC-0056 group on state organizations of Ukraine using malicious programs SaintBot and OutSteel (CERT-UA #3799)CERT-UA ↗
  2. 2022Threat Actor UAC-0056 Targeting Ukraine with Fake Translation SoftwareSentinelone ↗
  3. 2022UAC-0056 cyberattack on Ukrainian authorities using GraphSteel and GrimPlant malwareCERT_UA ↗

Take it with you

keyless · no signup

References

10 sources
  1. 1.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting…
  2. 2.msrc-blog.microsoft.com/2022/02/28/analysis-resources-cyber-threat-activity-uk…
  3. 3.unit42.paloaltonetworks.com/atoms/ruinousursa
  4. 4.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-…
  5. 5.microsoft.com/en-us/security/blog/2022/02/04/actinium-targets-ukrain…
  6. 6.attack.mitre.org/groups/G1003
  7. 7.crowdstrike.com/blog/who-is-ember-bear
  8. 8.mandiant.com/resources/russia-invasion-ukraine-retaliation
  9. 9.unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot
  10. 10.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military…

Track DEV-0586 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.