![APT Profile – Volt Typhoon vs. Flax Typhoon](https://eurepoc.eu/wp-content/uploads/2024/08/Advanced-Persistent-Threat-Profile-VoltFlax-Typhoon-01.jpg)
APT Profile – Energetic Bear
- 17 November 2022
- Zettl-Schabath, Kerstin; Gschwend, Timothy; Borrett, Camille
- EN
About Energetic Bear
Energetic Bear is a state-integrated group (military intelligence service/agency members): The United States Cybersecurity and Infrastructure Security Agency (CISA) and the US Department of Justice (DoJ) referred to Energetic Bear as a “Russian state-sponsored APT actor” ([10]), citing target selection and aimed intelligence-gathering as strong indicators ([5]). According to Symantec, Energetic Bear displays a sufficiently high degree of technical capability which also assumes that the group is able to draw on state resources, both human and material. Additionally, as reported by Crowdstrike, the target selection of the group seems to align very closely with the likely information collection priorities of the Russian foreign, domestic, and military intelligence services; the SVR, FSB and GRU respectively.
Associated APT designations
- Berserk Bear/Energetic Bear (CrowdStrike)
- Dragonfly (2.0) (Symantec)
- Crouching Yeti (Kaspersky)
- G0035 (MITRE ATT&CK)
Country of origin
Period of activity
Since at least 2010
More APT profiles
- Research and Analysis
![APT Profile – Volt Typhoon vs. Flax Typhoon](https://eurepoc.eu/wp-content/uploads/2024/08/Advanced-Persistent-Threat-Profile-VoltFlax-Typhoon-01.jpg)
![APT Profile – Lazarus Group](https://eurepoc.eu/wp-content/uploads/2024/02/Advanced-Persistent-Threat-Profile-Lazarus-February-2024-01.jpg)
![APT Profile – APT3/Boyusec](https://eurepoc.eu/wp-content/uploads/2023/09/Advanced-Persistent-Threat-Profile-APT3-3-01.jpg)