DEV-0586, also known as Cadet Blizzard or Ruinous Ursa, is a Russian state-sponsored cyber threat group assessed with high confidence to be affiliated with the Russian General Staff Main Intelligence Directorate (GRU) and its Unit 29155. The group has been operational since at least 2020, gaining prominence in early 2022 with its deployment of destructive WhisperGate malware against Ukrainian targets. DEV-0586's primary motivation is disruption, destruction, espionage, and information collection, aligning with Russian military and intelligence objectives. What distinguishes DEV-0586 from other established GRU-affiliated groups is its comparatively lower degree of operational security and its suspected employment of junior GRU officers and non-GRU actors. The group is known for deploying wiper malware that masquerades as ransomware but lacks recovery mechanisms, and for conducting hack-and-leak operations. It operates under several aliases, including Cadet Blizzard (Microsoft's designat

Aliases del actor

Cadet BlizzardRuinous UrsaUAC-0056Lorec53Bleeding BearSaint BearUNC2589incluyendo brechas de seguridadransomware

Actores similares

Saint Bearactor · 1APT29 (Cozy Bear)actor · 1energetic-bearactor · 1ember-bearactor · 1Energetic Bearapt · 0Boulder Bearapt · 0Pat Bearapt · 0White Bearapt · 0spacebearsransomware · 26SaintBearapt · 0