space bears
Ransomware group profile
Description
SpaceBears is a ransomware group that primarily focuses on high-profile cyberattacks across various industries. Known for employing sophisticated tactics, they utilize advanced encryption and double extortion methods while also operating as a data broker. Their operations have a global reach, making significant impacts on targeted organizations.
Key insights
- •Employs double extortion tactics by encrypting data and threatening to publish it online.
- •Targets a wide range of sectors, including healthcare and energy, capitalizing on vulnerabilities related to ongoing events like the COVID-19 pandemic.
- •Gains initial access through social engineering, phishing, and exploiting known software vulnerabilities.
- •Adopts zero-day vulnerabilities for breaches, indicating a shift towards more advanced hacking techniques.
- •Ransom demands are typically high, reflecting their focus on financial gain through data exfiltration.
Threat Level & Status Breakdown
For space bears · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for space bears in the selected period
No intelligence data for this group.
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for space bears
T1486
T1486
T1490
T1490
T1078
T1078
T1041
T1041
T1562
T1562
T1021
T1021
T1059
T1059
T1021.001
T1021.001
T1105
T1105
T1033
T1033
T1110
T1110
T1583
T1583
Victims(56)
| Company | Domain | Country | Industry | Status | Discovered | |
|---|---|---|---|---|---|---|
| Stellar | — | — | — | Claimed | 1 day ago | |
| Ridge Law Firm | — | US United States | Professional Services | Claimed | 8 days ago | |
| Gestordes | — | ES Spain | Professional Services | Claimed | 8 days ago | |
| BASE SPA | — | IT Italy | Transportation | Claimed | 9 days ago | |
| Filabé | — | CH Switzerland | Healthcare | Claimed | 9 days ago | |
| Hunter | — | — | Technology | Claimed | 9 days ago | |
| SmilePoint Dental Group | — | US United States | Healthcare | Claimed | 23 days ago | |
| Erla Technologies SAS | — | FR France | Technology | Claimed | 30 days ago | |
| Johnson & Johnson Innovative Medicine | — | US United States | Healthcare | Claimed | about 1 month ago | |
| Ultimate Metals | — | GB United Kingdom | Manufacturing | Claimed | about 2 months ago | |
| Asaniverko | — | BE Belgium | Professional Services | Claimed | about 2 months ago | |
| Brooklands of Mornington | — | AU Australia | Hospitality | Claimed | about 2 months ago | |
| Bonheure | — | JP Japan | Retail & E-Commerce | Claimed | 3 months ago | |
| AbelZeta | — | US United States | Technology | Claimed | 3 months ago | |
| Elgon Cosmetic | — | IT Italy | Manufacturing | Claimed | 4 months ago | |
| Wagner Metal Concept | — | DE Germany | Manufacturing | Claimed | 4 months ago | |
| Kymco | — | TW Taiwan | Manufacturing | Claimed | 4 months ago | |
| Darma Henwa | — | ID Indonesia | Energy & Utilities | Claimed | 4 months ago | |
| Sitran MG | — | BR Brazil | Transportation | Claimed | 4 months ago | |
| Buff Law | — | US United States | Professional Services | Claimed | 4 months ago |
Page 1 of 3
Affected countries(34)
Countries where this group has been reported to target or leak victims.