Threat actor
Berserk Bear
Russia · espionage
Tracked by CyberSIXT since 25 Nov 2025
- Articlesall time
- 4
- Articleslast 30 days
- 2
- CVEs exploitedattributed · all time
- 0
- Research reportsall time
- 2
6 articles from 4 outlets since 25 Nov 2025; 3 in the last 7 days.
- Article
- First report
- Research report
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Fri 23 Oct · 07:26 UTC | SecurityOnline | Sophos Uncovers BRONZE SANDCASTLE Using Sandboxie to Load Malware |
| Wed 21 Oct · 15:22 UTC | SecurityWeek | Ransomware attackers exploit severe flaws within three days, Rapid7 warns |
| Wed 21 Oct · 12:58 UTC | The Hacker News | China Aligned Bronze Sandcastle Uses DLL Sideloading to Spy on Organisations |
| Mon 13 Jul · 10:51 UTC | Infosecurity | UK, EU sanction Russian hackers using weak SNMP router passwords |
| Mon 13 Jul · 09:52 UTC | SecurityOnline | FSB Center 16 Targets Routers Across Critical Sectors |
| Tue 25 Nov 2025 · 14:55 UTC | SOCRadar | Dark Web Profile: Berserk Bear |
Connections
10 tools- Malware and tools
- Mimikatz, PsExec, Net, Reg, Backdoor.Oldrea, Trojan.Karagany, netsh, Impacket, CrackMapExec, MCMD
Names and sources
20 names- ENERGETIC BEAR
- CyberSIXT coverage, Malpedia, MISP Galaxy, MITRE ATT&CK®
- ALLANITE
- Malpedia, MISP Galaxy
- ATK6
- Malpedia, MISP Galaxy
- BERSERK BEAR
- Malpedia, Microsoft, MISP Galaxy, MITRE ATT&CK®
- BROMINE
- Malpedia, Microsoft, MISP Galaxy, MITRE ATT&CK®
- Blue Kraken
- Malpedia, Microsoft, MISP Galaxy
- CASTLE
- Malpedia, MISP Galaxy
- Crouching Yeti
- Malpedia, Microsoft, MISP Galaxy, MITRE ATT&CK®
12 more names
- DYMALLOY
- Malpedia, MISP Galaxy, MITRE ATT&CK®
- Dragonfly
- Malpedia, Microsoft, MISP Galaxy, MITRE ATT&CK®
- G0035
- Malpedia, MISP Galaxy
- Ghost Blizzard
- Malpedia, Microsoft, MISP Galaxy, MITRE ATT&CK®
- Group 24
- Malpedia, MISP Galaxy
- Havex
- Malpedia, MISP Galaxy
- IRON LIBERTY
- Malpedia, MISP Galaxy, MITRE ATT&CK®
- ITG15
- Malpedia, MISP Galaxy
- Koala Team
- Malpedia, Microsoft, MISP Galaxy
- TG-4192
- Malpedia, Microsoft, MISP Galaxy, MITRE ATT&CK®
- TEMP.Isotope
- MITRE ATT&CK®
- BRONZE SANDCASTLE
- CyberSIXT coverage
Attributed facts
- Origin
Russia Microsoft · Ghost Blizzard, MISP Galaxy
- Sponsor
Russian Federation MISP Galaxy
- Category
State Microsoft · Ghost Blizzard
- Motivation
Espionage MISP Galaxy
- Sectors
Energy, Government, Private sector MISP Galaxy
- Suspected victims
China, France, Germany, Ireland, Italy, Japan, Poland, Spain, Turkey, United States MISP Galaxy
Malware and tools
MITRE ATT&CK® · G0035 10
MITRE ATT&CK® techniques
56 techniques · 0 tacticsFrom MITRE ATT&CK® · G0035
Tactic mappings not recorded.
Tactics pending refresh56
T1003.002Security Account ManagerT1003.003NTDST1003.004LSA SecretsT1005Data from Local SystemT1012Query RegistryT1016System Network Configuration Discovery+50 more
T1018Remote System DiscoveryT1021.001Remote Desktop ProtocolT1033System Owner/User DiscoveryT1036.010Masquerade Account NameT1053.005Scheduled TaskT1059Command and Scripting InterpreterT1059.001PowerShellT1059.003Windows Command ShellT1059.006PythonT1069.002Domain GroupsT1070.004File DeletionT1071.002File Transfer ProtocolsT1074.001Local Data StagingT1078Valid AccountsT1083File and Directory DiscoveryT1087.002Domain AccountT1098.007Additional Local or Domain GroupsT1105Ingress Tool TransferT1110Brute ForceT1110.002Password CrackingT1112Modify RegistryT1113Screen CaptureT1114.002Remote Email CollectionT1133External Remote ServicesT1135Network Share DiscoveryT1136.001Local AccountT1187Forced AuthenticationT1189Drive-by CompromiseT1190Exploit Public-Facing ApplicationT1195.002Compromise Software Supply ChainT1203Exploitation for Client ExecutionT1204.002Malicious FileT1210Exploitation of Remote ServicesT1221Template InjectionT1505.003Web ShellT1547.001Registry Run Keys / Startup FolderT1560Archive Collected DataT1564.002Hidden UsersT1566.001Spearphishing AttachmentT1583.001DomainsT1583.003Virtual Private ServerT1584.004ServerT1588.002ToolT1591.002Business RelationshipsT1595.002Vulnerability ScanningT1598.002Spearphishing AttachmentT1598.003Spearphishing LinkT1608.004Drive-by TargetT1685.005Clear Windows Event LogsT1686Disable or Modify System Firewall© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
- Sophos Uncovers BRONZE SANDCASTLE Using Sandboxie to Load MalwareSecurityOnline
- Ransomware attackers exploit severe flaws within three days, Rapid7 warnsSecurityWeek
- China Aligned Bronze Sandcastle Uses DLL Sideloading to Spy on OrganisationsThe Hacker News
- UK, EU sanction Russian hackers using weak SNMP router passwordsInfosecurity
- FSB Center 16 Targets Routers Across Critical SectorsSecurityOnline
- Dark Web Profile: Berserk BearSOCRadar · first in our coverage