Signalis
sign in--:--:--UTC
Threat actors

FSB Center 16

☆ pin
MITRE G0100Also known as Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard, Static Tundra
Reports
3
First seen
Jul 13, 2026
Last seen
Jul 14, 2026
Motivation
Espionage

Relationships

CVE-2008-4128, in 2 of FSB Center 16's reports, exploited in the wild×2CVE-2008-4128CVE-2018-0171, in 2 of FSB Center 16's reports, exploited in the wild×2CVE-2018-0171Co-mentioned with FSB Center 16 in 1 Signalis report (co-mention, not confirmed collaboration)×1APT28Co-mentioned with FSB Center 16 in 1 Signalis report (co-mention, not confirmed collaboration)×1gruunit29155Reports targeting Energy & UtilitiesEnergy & UtilitiesFSB Center 16

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors
Energy & Utilities ×1

Top ATT&CK techniques

T1190 Exploit Public-Facing Application ×3T1070.004 Indicator Removal on Host: File Deletion ×1T1602.002 Data from Configuration Repository: Network Device Configuration Dump ×1T1003 OS Credential Dumping ×1T1027 Obfuscated Files or Information ×1T1046 Network Service Discovery ×1T1041 Exfiltration Over C2 Channel ×1T1595.001 Active Scanning: Scanning IP Blocks ×1T1583.003 Acquire Infrastructure: Virtual Private Servers ×1T1602.001 Data from Configuration Repository: SNMP (MIB Dump) ×1T1021.001 Remote Services: Remote Desktop Protocol ×1T1090 Proxy ×1

Indicators

email ×10url ×6cve ×4domain ×3

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2008-4128 (exploited)CVE-2018-0171 (exploited)

Recent reports

High

U.S. Sanctions First VPN Service and Malware Cryptor Seller Over Ransomware Support

The Hacker NewsHigh

Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting

CISA AdvisoriesCritical

US and allies warn of Russian critical infrastructure attacks

Bleeping Computer

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans