Dark Web Profile: Berserk Bear

The article provides a comprehensive overview of Berserk Bear, a Russian state-sponsored cyber espionage group linked to the FSB, active since at least 2010. It details their history, operations, and targets, primarily focusing on critical infrastructure in the energy and utility sectors. Berserk Bear employs sophisticated tactics, including phishing, supply-chain attacks, and exploiting vulnerabilities in network devices to gain long-term access to systems.

The article outlines their operational methods, including initial access, execution, persistence, privilege escalation, and data exfiltration. It also offers defense strategies against Berserk Bear's tactics and highlights how SOCRadar can assist organizations in mitigating risks associated with such threats. Additionally, it includes a table of MITRE ATT&CK techniques used by Berserk Bear.