Home/Threat Actor/Cadet Blizzard
Threat Actor

Cadet Blizzard

cadet_blizzard · russia · active since 2020

Cadet Blizzard (Ember Bear / Bleeding Bear / DEV-0586 / Frozenvista / UNC2589 / G1040) is a Russian state-sponsored sabotage-and- destruction-focused cyber cluster attributed by formal September 5, 2024 ten-country joint Cybersecurity Advisory AA24-249A to "29155 Cyber Actors" within GRU Unit 29155, the Russian Military Intelligence Directorate 29155th Unit historically associated with the 2018 Salisbury Skripal poisoning, the 2014 Czech Vrbětice ammunition depot bombing, and the 2016 Montenegro coup-attempt plot, placing the cluster at the top tier of formally-attributed Russian-state-cyber clusters alongside the existing APT28, APT29, Sandworm, Turla, Dragonfly, Gamaredon, and Star Blizzard coverage in this corpus, with the WhisperGate Master-Boot-Record wiper deployment against approximately 70 Ukrainian government, IT, and financial-services organizations on January 13-14, 2022 (six weeks before the February 24, 2022 full-scale invasion of Ukraine) as the foundational reference event, and continued operations through 2024-2025 against Ukrainian, NATO-member, EU, and North American government, defense, and critical-infrastructure targets operating in a dual sabotage-and-influence-operations portfolio distinct from both pure-espionage peer clusters (APT28, APT29, Turla, Star Blizzard) and the industrial-control-system-scale destructive operations of Sandworm.

russia confidence: high 31 aliases MITRE ATT&CK G1003 ↗

Profile

Cadet Blizzard (also tracked as Ember Bear, Bleeding Bear, DEV-0586, Storm-0586, Frozenvista, UNC2589, TA471, and MITRE ATT&CK G1040) is a Russian state-sponsored sabotage-and-destruction-focused cyber cluster attributed by formal ten-country joint Cybersecurity Advisory AA24-249A (September 5, 2024) to "29155 Cyber Actors" within GRU Unit 29155, the Russian Main Intelligence Directorate 29155th Unit historically associated with sabotage, assassination, and influence operations including the 2018 Salisbury nerve-agent poisoning of Sergei and Yulia Skripal, the 2014 Czech Vrbětice ammunition depot bombing, and the 2016 Montenegro coup-attempt plot. The September 2024 attribution at the GRU-Unit-29155 level is high-confidence, jointly issued by US FBI / CISA / NSA / State Department / Treasury, UK NCSC, Estonian RIA + Välisluureamet, Latvian SAB, Lithuanian NCSC, Polish ABW, Czech Military Intelligence + BIS, Canadian Centre for Cyber Security, German BSI, and Ukrainian SBU. The ten-country attribution places Cadet Blizzard at the top tier of formally-attributed Russian-state- cyber clusters alongside APT28 (GRU Unit 26165), APT29 (SVR), Sandworm (GRU Unit 74455), Turla (FSB Centre 16), Dragonfly (FSB Centre 16), Gamaredon (FSB Centre 18), and Star Blizzard (FSB Centre 18). GRU Unit 29155 represents the broader GRU military-intelligence sabotage directorate's pivot into cyber operations alongside its kinetic and influence portfolios. The unit is operationally distinct from GRU Unit 74455 (Sandworm, Main Centre for Special Technologies, focused on destructive cyber operations against critical infrastructure including the 2015-2016 Ukrainian electric-grid attacks, the 2017 NotPetya wiper, and the 2018 Olympic Destroyer attack on the Pyeongchang Winter Olympics, already covered as sandworm_team.yaml) and from GRU Unit 26165 (APT28 / Fancy Bear, focused on cyber-espionage and information operations including the 2016 DNC intrusion and the 2018 World Anti-Doping Agency operations, already covered as apt28_fancybear. yaml). Unit 29155's cyber portfolio is conceptually positioned as sabotage-and-influence-operations adjacent to its kinetic sabotage activity rather than as either pure espionage or pure destructive cyber-warfare. The foundational reference event for the cluster is the WhisperGate destructive-malware deployment of January 13-14, 2022 against approximately 70 Ukrainian government, IT, and financial- services organizations. WhisperGate operated as a Master Boot Record (MBR) wiper disguised as ransomware: the malware overwrote the victim machine's MBR with a ransom note and then proceeded to destroy file contents using a second-stage component. The ransomware decoy was deliberately deceptive, the malware was designed for destruction rather than financial extortion. The WhisperGate deployment occurred approximately six weeks before Russia's February 24, 2022 full-scale invasion of Ukraine and represented one of the first publicly-documented pre-invasion Russian cyber-sabotage operations. WhisperGate was accompanied by mass defacement of Ukrainian government websites with anti- Ukrainian messaging. Operationally Cadet Blizzard's toolkit centers on the WhisperGate MBR wiper, defacement tooling, destructive batch and PowerShell scripts, web shells (China Chopper, custom), and conventional living-off-the-land tooling (Cobalt Strike Beacon, Mimikatz, Impacket, PsExec, CrackMapExec). Initial access patterns include spear-phishing with weaponized Office documents and exploitation of public-facing vulnerabilities, the September 2024 advisory documented exploitation of approximately fifteen specific CVEs across Confluence, VMware, Outlook, Microsoft Office, Ivanti, Zimbra, and other public-facing-software vulnerabilities. A defining cluster characteristic is the dual portfolio of destructive operations alongside intelligence collection, the cluster does not operate as a pure espionage cluster (like APT28, APT29, Turla, Star Blizzard) and does not operate at the scale of Sandworm's industrial-control-system-targeted destructive operations. Cadet Blizzard occupies a distinct operational niche consistent with GRU Unit 29155's broader sabotage-and-influence mission profile. A handful of operational notes: First, the cluster's vendor-naming proliferation (Cadet Blizzard / Ember Bear / Bleeding Bear / DEV-0586 / Storm-0586 / Frozenvista / UNC2589 / TA471) reflects more than two years of fragmented pre- consolidation vendor tracking. Modern reporting should default to "Cadet Blizzard" as the Microsoft-canonical name.

"Ember Bear" remains the CrowdStrike-canonical name. Second, the cluster is operationally distinct from Sandworm (GRU Unit 74455, already covered as sandworm_team.yaml). The two clusters share Russian state sponsorship and destructive-cyber- operations mission elements but operate under different GRU units with different historical missions and different operational portfolios. Sandworm's signature destructive operations (BlackEnergy, Industroyer, NotPetya, Olympic Destroyer, HermeticWiper, CaddyWiper, Industroyer2, AcidRain) operate at substantially higher technical tier and broader scale than Cadet Blizzard's WhisperGate-class operations. Third, the September 2024 ten-country joint attribution event was the most comprehensive coordinated Western attribution of a Russian cyber cluster to date in terms of number of participating countries (ten plus EU), exceeding even the December 2023 Star Blizzard attribution (six participating countries) and the March 2022 Dragonfly DOJ indictment (US-only at the indictment level). The breadth of the attribution reflects sustained Cadet Blizzard targeting of Central, Eastern, and Northern European NATO member states alongside North American targets. Fourth, the cluster's relationship to Lorec53, a separately- tracked Russian-aligned cluster sometimes proposed as a Cadet Blizzard predecessor or adjacent cluster, remains analytically open. Treat as adjacent but separate unless reporting explicitly identifies cross-cluster overlap.

Aliases

31
cadet blizzardcadet_blizzardcadetblizzardember bearember_bearemberbearbleeding bearbleeding_bearbleedingbeardev-0586dev_0586storm-0586storm_0586frozenvistafrozen vistafrozen_vistaunc2589unc_2589ta471ta_471lorec53 overlaplorec_53_overlaphatchet teamhatchet_teamgru unit 29155gru_unit_2915529155 cyber actors29155_cyber_actorsin9155in_9155g1040

MITRE ATT&CK aliases

1
Additional names MITRE lists for G1003.
UAC-0056

Notable Campaigns

8
2024-2025Continued Operations (2024-2025)
2024September 5, 2024 Ten-Country Joint Advisory, Cadet Blizzard Attributed to GRU Unit 29155 (AA24-249A)
2023-2024Hack-and-Leak and Influence Operations (2023-2024)
2023Microsoft Cadet Blizzard Renaming and GRU Attribution (June 14, 2023)
2022-2024Sustained Ukrainian and NATO Critical-Infrastructure Targeting (2022-2024)
2022WhisperGate Wiper Deployment Against Ukraine (January 13-14, 2022)
2022Microsoft DEV-0586 Disclosure (January 15, 2022)
2022CISA AA22-057A, Update on WhisperGate and HermeticWiper (February 26, 2022)

Attribution & Reporting

Attributed by
US Federal Bureau of Investigation (FBI)US Cybersecurity and Infrastructure Security Agency (CISA)US National Security Agency (NSA)US Department of StateUS Department of the TreasuryUK National Cyber Security Centre (NCSC)Estonian Information System Authority (RIA)Estonian Välisluureamet (Foreign Intelligence Service)Latvian State Security ServiceLithuanian National Cyber Security CentrePolish Internal Security Agency (ABW)Czech Military IntelligenceCzech Security Information Service (BIS)Canadian Centre for Cyber SecurityGerman Federal Office for Information Security (BSI)Ukrainian Security Service (SBU)MicrosoftMicrosoft Threat Intelligence CenterCrowdStrikeSentinelOneMandiantCisco TalosRecorded Future Insikt GroupSymantecESETProofpointCluster25
Key reporting
reportMicrosoft Threat Intelligence Center: Destructive Malware Targeting Ukrainian Organizations (January 15, 2022), WhisperGate seminal disclosure
reportCISA / FBI / NSA AA22-057A: Update on WhisperGate and HermeticWiper Destructive Malware (February 26, 2022)
reportMicrosoft: Cadet Blizzard Emerges as a Novel and Distinct Russian Threat Actor (June 14, 2023), Microsoft renaming and GRU attribution
reportJoint Cybersecurity Advisory AA24-249A: Russian Military Cyber Actors Target US and Global Critical Infrastructure (September 5, 2024), seminal ten-country GRU Unit 29155 attribution
reportFBI / CISA / NSA / Department of State / Department of Treasury / UK NCSC / Estonian RIA + Välisluureamet / Latvian SAB / Lithuanian NCSC / Polish ABW / Czech Military Intelligence + BIS / Canadian Centre for Cyber Security / German BSI / Ukrainian SBU: Joint Attribution to GRU Unit 29155 (September 5, 2024)
reportCisco Talos: Ukraine Campaign Delivers Defacement and Wiper Malware (January 2022)
reportSentinelOne Labs: WhisperGate Ukrainian Malware Analysis (January 2022)
reportCrowdStrike: Who Is EMBER BEAR? (multiple years)
reportMandiant: UNC2589 / Cadet Blizzard Tracking
reportUK NCSC: UK and Allies Expose Russian Intelligence Services for Cyber Campaign of Attempted Political Interference (September 5, 2024)
reportUK Government: UK and Allies Expose Russian Military Intelligence Cyber Campaign (September 2024)
reportMalpedia Actor Profile: Cadet Blizzard
reportMITRE ATT&CK Group G1040, Cadet Blizzard

Operational

State sponsor

Russia, Main Intelligence Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU), Unit 29155 ("29155 Cyber Actors"). Attribution at the GRU-Unit-29155 level is high-confidence following the September 5, 2024 ten-country joint Cybersecurity Advisory AA24-249A "Russian Military Cyber Actors Target US and Global Critical Infrastructure" issued jointly by the US Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Department of State, Department of the Treasury, UK National Cyber Security Centre (NCSC), Estonian Information System Authority (RIA) and Foreign Intelligence Service (Välisluureamet), Latvian State Security Service, Lithuanian National Cyber Security Centre, Polish Internal Security Agency (ABW), Czech Military Intelligence and Security Information Service (BIS), Canadian Centre for Cyber Security, German Federal Office for Information Security (BSI), and Ukrainian Security Service (SBU). The advisory explicitly attributed Cadet Blizzard operations to "29155 Cyber Actors" within GRU Unit 29155, a unit historically associated with sabotage, assassination, and influence operations including the 2018 Salisbury nerve-agent poisoning of Sergei and Yulia Skripal, the 2014 Czech Vrbětice ammunition depot bombing, and the 2016 Montenegro coup-attempt plot.

GRU Unit 29155 is operationally distinct from GRU Unit 74455 (Sandworm, Main Centre for Special Technologies, already covered as sandworm_team.yaml) and from GRU Unit 26165 (APT28, already covered as apt28_fancybear.yaml). Unit 29155 represents the broader GRU military-intelligence sabotage directorate's pivot into cyber operations alongside its kinetic and influence portfolios.

Motivations
sabotage, destructive_operations, influence_operations, intelligence_gathering, espionage, geopolitical_disruption, critical_infrastructure_targeting, hack_and_leak_operations
Sectors
Regions

Detection Blind Spots

60 techniques
Across this actor’s 60 mapped techniques, the share covered by each detection layer. Low bars are where you’d be blind if this actor targeted you.
Behavioral / log (Sigma)56/60 · 93%
Analytics (MITRE CAR)31/60 · 51%
Runtime / container (Falco)6/60 · 10%
File / malware (YARA)0/60 · 0%
Network (Suricata/Snort)15/60 · 25%
Vuln scan (Nuclei)0/60 · 0%

Atomic Test Plan

30 techniques
Runnable Atomic Red Team tests covering this actor’s mapped techniques - validate your detections against this specific adversary. Cross-reference the blind spots above. For authorized lab / purple-team use. Open the full builder

Tools Used

3 mapped
Other tooling / TTPs (curation, not ATT&CK-mapped):
MASTER BOOT RECORD WIPERMBR WIPERMSHTAMSI INSTALLER ABUSESMBEXECSTAGE1.EXE WHISPERGATESTAGE2.EXE WHISPERGATE
Intelligence Graph · click any node to traverse
CVETechnique ActorTool Family
drag to reposition · click any node to traverse · button top-right enlarges
External lookups - second-class, for what we don’t hold ourselves
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin