From 5f27835a4c27cc01085f40f31c9b5a82786eb2f0 Mon Sep 17 00:00:00 2001
From: Mathieu4141 <mathieu@feedly.com>
Date: Tue, 12 Nov 2024 06:58:58 -0800
Subject: [PATCH] [threat-actors] Add SpaceBears

---
 clusters/threat-actor.json | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 5825953e..dbe7a2ec 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -17304,6 +17304,17 @@
       },
       "uuid": "4f356e2b-8988-4d6b-84e8-d4362764aea0",
       "value": "SYLHET GANG-SG"
+    },
+    {
+      "description": "SpaceBears is a ransomware group believed to be based in Moscow, Russia, that has taken credit for several high-profile cyberattacks while primarily operating as a Data Broker. They currently list eight organizations on their Data Leak Site, focusing on medium to small-sized targets. Their methods suggest a reliance on basic extortion strategies rather than sophisticated malware tactics, with no advanced techniques or indicators of ransomware detected.",
+      "meta": {
+        "country": "RU",
+        "refs": [
+          "https://socradar.io/dark-web-profile-spacebears/"
+        ]
+      },
+      "uuid": "9900e010-f7ca-4354-b969-a5cd2b02f9d3",
+      "value": "SpaceBears"
     }
   ],
   "version": 320