---
title: 'Ember Bear: GRU Unit 29155 and WhisperGate'
url: https://www.emergentmind.com/topics/ember-bear
type: topic
---

# Ember Bear: GRU Unit 29155 and WhisperGate

Ember Bear refers to the threat actor designation for GRU Unit 29155, a division of Russian military intelligence, formally attributed as the primary operator responsible for the WhisperGate wiper campaign targeting Ukrainian government entities on January 13, 2022. The attribution of WhisperGate to Ember Bear has been established through triangulation of open-source technical reports, U.S. Department of Justice indictments, vendor advisories (Microsoft, CrowdStrike), and corroborative intelligence such as GRU server log leaks. Technical attribution leverages both machine learning–based statistical methods and large language model–driven semantic analysis to differentiate Ember Bear from overlapping Russian APT groups—specifically Sandworm (GRU Unit 74455)—by examining indicators of compromise (IoCs), unique toolsets, and tactics, techniques, and procedures (TTPs) [2510.18484].

## 1. Establishment and Attribution of Ember Bear

Attribution of Ember Bear as responsible for WhisperGate relies on convergent evidence:

- **Legal and Intelligence Sources:** A U.S. Department of Justice indictment (5 Sep 2024) charges five named officers of GRU Unit 29155, as well as Amin Stigal, explicitly for their operational roles in WhisperGate. The Insider’s publication of leaked GRU server logs further exposes recruitment and operational details linking Unit 29155 to the campaign.
- **Vendor and Open-source Analysis:** CrowdStrike (Mar 2022) and Microsoft (Jun 2023, Cadet Blizzard advisory renaming DEV-0586) both identify the adversary behind WhisperGate as a GRU entity, with Microsoft referencing Ember Bear in technical documentation and CrowdStrike introducing the Ember Bear nomenclature.
- **MITRE ATT&CK Profile:** Ember Bear is indexed as G1003, codifying its toolset and behaviors within the ATT&CK knowledge base.

This corpus of legal and technical evidence results in a consensus attribution of WhisperGate to Ember Bear, distinguishing it from other concurrently active GRU APT units (e.g., Sandworm) [2510.18484].

## 2. Technical Artifacts: Indicators of Compromise and TTPs

Observed IoCs from the WhisperGate campaign and subsequent Ember Bear operations are characterized by the following:

- **Discord CDN Payload Hosting (T1102/T1105):** Download links such as `hxxps://cdn.discordapp.com/.../Tbopbh.jpg`, `saint.exe` (the SaintBot downloader), and related stage2 binaries were distributed via Discord's CDN as a primary ingress mechanism.
- **Phishing and Macro-lures (T1566.001, T1204.002):** Malicious, macro-enabled Word documents served as initial infection vectors, commonly retrieving payloads (`test01.exe`, `load2022.exe`, etc.) from attacker-controlled infrastructure.
- **Destructive Disk Wipe (T1561.001):** WhisperGate exhibited wiper-style disk-erase routines similar in execution flow to other Russian wiper malware, but mapped distinctly in execution details.
- **Unique Toolset:** The use of SaintBot, OutSteel, GraphSteel, and GrimPlant binaries is unique to Ember Bear and codified in MITRE ATT&CK G1003.
- **PowerShell and Command Shell Activity (T1059.001/.003):** Observed in both campaign telemetry and tools, supporting both lateral movement and payload deployment.
- **Password Spraying (T1110.003):** Detected within the context of fine-tuning attribution datasets.

**Table: Representative Ember Bear IoCs in WhisperGate**:

| Payload/Binary         | Distribution Vector      | Purpose/Role               |
|------------------------|-------------------------|----------------------------|
| saint.exe              | Discord CDN             | SaintBot Downloader        |
| test01.exe → load2022.exe | Macro-enabled Word | Loader/Stage2 Payload      |
| puttyjejfrwu.exe, asd.exe | Discord CDN or macro  | Secondary utilities/tools  |

These artifacts, in aggregate, are supplemented by TTPs such as phishing lures and the exclusive use of the SaintBot toolset [2510.18484].

## 3. Statistical Attribution Using Machine Learning

Traditional ML models were employed to attribute WhisperGate to APT groups, using WhisperGate feature vectors mapped to ten Russian APT clusters. Classifiers included k-Nearest Neighbors (KNN), Decision Trees, Random Forest, AdaBoost (SAMME), Support Vector Machines (SVM with linear and RBF kernels), Gaussian Naive Bayes (GaussianNB), and neural networks. Key mathematical formulations:

- **Naive Bayes posterior:**
  $$
  P(C\mid X) = \frac{P(C)\prod_{i=1}^n P(x_i\mid C)}{P(X)}
  $$
- **SVM decision function:**
  $$
  f(x) = \mathrm{sign}(w^\mathsf{T}x + b)
  $$

The attribution results, reported as per-class likelihood percentages, showed a split in classifier outputs:

| Classifier     | Ember Bear (%) | Sandworm (%) |
|----------------|---------------|--------------|
| GaussianNB     | 91.8          | 0            |
| KNN            | 34.7          | 22.4         |
| Decision Tree  | 36.7          | 30.6         |
| Random Forest  | 30.6          | 38.8         |
| AdaBoost       | 0             | 93.9         |
| Linear SVM     | 0             | 89.8         |
| RBF SVM        | 6.1           | 69.4         |
| Neural Net     | 0             | 91.8         |

Notably, only GaussianNB assigns high probability mass (91.8%) to Ember Bear, whereas other algorithms more frequently favor Sandworm, reflecting the challenges in statistical attribution in the presence of TTP overlap [2510.18484].

## 4. Large Language Models and Semantic Attribution

Semantic attribution via ChatGPT 4o included:

- **Prompt Modalities:**
  - *Zero-context* (IoCs only): Highest likelihoods assigned to Sandworm (80%) and APT29 (70%), reflecting the difficulty of attribution given only behaviorally similar indicators.
  - *Context-enriched* (retrieval-augmented generation, RAG): Prepending snippets from Ember Bear–specific documents (MITRE G1003, CrowdStrike, The Insider) shifts the model's top attribution to Ember Bear (85% likelihood), ahead of Sandworm (75%).

- **RAG Workflow:**
  1. Retrieval of group-specific intelligence.
  2. Augmentation of the input context for the LLM.
  3. Attribution based on both statistical and semantic reasoning.

No novel loss functions or architecture changes were applied; fine-tuning was achieved by contextual augmentation and prompt engineering as opposed to gradient-based re-training. This demonstrates the effectiveness of LLMs in leveraging external structured intelligence to boost actor attribution confidence [2510.18484].

## 5. Distinguishing Ember Bear from Sandworm

While Ember Bear and Sandworm share several technical indicators, clear delineators exist:

- **Overlapping Indicators:** Discord CDN for payloads, disk-wipe routines, command shell/PowerShell TTPs.
- **Unique Attributes:** Only Ember Bear employs the SaintBot, OutSteel, GraphSteel, and GrimPlant toolset (MITRE G1003). The U.S. indictment specifically implicates GRU Unit 29155 officers and Amin Stigal, and leaked GRU server logs reveal direct WhisperGate operationalization by Unit 29155. Only GaussianNB among ML classifiers, and RAG-augmented LLMs, provided evidence strongly favoring Ember Bear attribution.

This partitioning underscores the necessity of combining behavioral, operational, and intelligence facets for robust attribution in the context of overlapping APT TTPs [2510.18484].

## 6. Implications and Methodological Reflections

The WhisperGate attribution case illustrates the requirement for a multifaceted approach combining:

- **Deterministic IoC Analysis:** Direct matching of binaries and server infrastructure.
- **Probabilistic Machine Learning:** Algorithms like GaussianNB can exploit the presence of group-unique features.
- **Generative AI/Semantic Analysis:** LLMs supplied with actor-specific documents enable grounded language-based reasoning, increasing attribution reliability amidst toolset reuse and false flags.

Operational and ethical considerations include the governance of classified intelligence integration, adversary model-poisoning threats, and maintaining human-in-the-loop oversight as AI assumes a greater role in cyber attribution workflows [2510.18484].

Source: https://www.emergentmind.com/topics/ember-bear