ENERGETIC BEAR

🇷🇺Russia-attributed

campaigns

aliases

Last seen:Mar 17, 2026

Intelligence Profile

A Russian group that collects intelligence on the energy industry.

Threat Analysis

ENERGETIC BEAR is a known-sophistication threat actor attributed to Russia, engaged in cyber operations with a primary motivation of espionage.

The group's espionage-oriented operations suggest a state-sponsored or state-aligned mandate, typically focused on stealing intellectual property, government secrets, or military intelligence. Targets are usually selected for strategic value rather than financial gain.

Known Campaigns

ENERGETIC BEAR — Active Operations March 2026

ENERGETIC BEAR is a unknown-motivation threat actor attributed to Russia. A Russian group that collects intelligence on the energy industry....

ACTIVEMEDIUM2026

External References

→https://www.gov.uk/government/publications/russias-fsb-malign-cyber-activity-factsheet/russias-fsb-malign-activity-factsheet

→https://web.archive.org/web/20161020180305/http://www.scmagazineuk.com/iran-and-russia-blamed-for-state-sponsored-espionage/article/330401/

→https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2014/Dragonfly_Threat_Against_Western_Energy_Suppliers.pdf

→http://www.netresec.com/?page=Blog&month=2014-10&post=Full-Disclosure-of-Havex-Trojans

→https://threatpost.com/energy-watering-hole-attack-used-lightsout-exploit-kit/104772/

→https://www.cfr.org/interactive/cyber-operations/crouching-yeti

→https://www.reuters.com/article/us-ukraine-cyber-attack-energy-idUSKBN1521BA

→https://dragos.com/wp-content/uploads/CrashOverride-01.pdf

→https://www.independent.ie/irish-news/statesponsored-hackers-targeted-eirgrid-electricity-network-in-devious-attack-36005921.html

→https://www.riskiq.com/blog/labs/energetic-bear/

Quick Facts

TypeAPT / Threat Group

Motivation🕵️ espionage

Origin🇷🇺 Russia

Aliases18

SourceMalpedia

Also Known As

BERSERK BEARDYMALLOYBROMINEDragonflyGhost BlizzardENERGETIC BEARATK6ITG15Blue KrakenGroup 24HavexG0035Crouching YetiTG-4192Koala TeamALLANITECASTLEIRON LIBERTY

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search ENERGETIC BEAR