Ransomware needs a way in. Stolen credentials are the cheapest one.
space bears Ransomware Group
Ransomware group profile
Description
SpaceBears is a ransomware group that primarily focuses on high-profile cyberattacks across various industries. Known for employing sophisticated tactics, they utilize advanced encryption and double extortion methods while also operating as a data broker. Their operations have a global reach, making significant impacts on targeted organizations.
Key insights
- •Employs double extortion tactics by encrypting data and threatening to publish it online.
- •Targets a wide range of sectors, including healthcare and energy, capitalizing on vulnerabilities related to ongoing events like the COVID-19 pandemic.
- •Gains initial access through social engineering, phishing, and exploiting known software vulnerabilities.
- •Adopts zero-day vulnerabilities for breaches, indicating a shift towards more advanced hacking techniques.
- •Ransom demands are typically high, reflecting their focus on financial gain through data exfiltration.
Threat Level & Status Breakdown
For space bears · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for space bears in the selected period
Intelligence
IOCs, YARA/Sigma rules, and related families for space bears
- 5butbkrljkaorg5maepuca25oma7eiwo6a2rlhvkblb4v6mf3ki2ovid.onion
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for space bears
T1486
T1486
T1490
T1490
T1078
T1078
T1041
T1041
T1562
T1562
T1021
T1021
T1059
T1059
T1021.001
T1021.001
T1105
T1105
T1033
T1033
T1110
T1110
T1583
T1583
Victims(33)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| Techpol-System | Poland | Claimed | about 2 months ago | |
| Blenheim | United Kingdom | Claimed | about 2 months ago | |
| Lösing Filtertechnik | Germany | Claimed | 3 months ago | |
| SICOL – JS Cobranças e Serviços | Brazil | Claimed | 3 months ago | |
| Haustechnik Geske | Germany | Claimed | 3 months ago | |
| Stellar | France | Claimed | 3 months ago | |
| Ridge Law Firm | United States | Claimed | 3 months ago | |
| BASE SPA | Italy | Claimed | 3 months ago | |
| Filabé of Switzerland | Switzerland | Claimed | 3 months ago | |
| Hunter | Ireland | Claimed | 3 months ago | |
| Erla Technologies | France | Claimed | 4 months ago | |
| Johnson & Johnson | United States | Claimed | 4 months ago | |
| 株式会社さわやか倶楽部 | Japan | Claimed | 6 months ago | |
| AbelZeta Pharma | United States | Claimed | 6 months ago | |
| Elgon Cosmetic | Italy | Claimed | 7 months ago | |
| WMC Metal Concepts | Germany | Claimed | 7 months ago | |
| SITRAN | Brazil | Claimed | 7 months ago | |
| Rosenthal Kooshoian & Lennon, LLP | United States | Claimed | 7 months ago | |
| Texcomp | Saudi Arabia | Claimed | 7 months ago | |
| Firmengruppe Hoffmann | Germany | Claimed | 8 months ago |
Page 1 of 2
Affected countries(36)
Countries where this group has been reported to target or leak victims.