SaintBear

G1031RU0 reports from 0 vendors

A group targeting UA state organizations using the GraphSteel and GrimPlant malware.

Vendor aliases (15)

The same group is tracked under different names by different vendors.

Vendor	Name
OSINT	UNC2589
OSINT	TA471
OSINT	UAC-0056
OSINT	Nascent Ursa
OSINT	Nodaria
OSINT	FROZENVISTA
OSINT	Storm-0587
OSINT	DEV-0587
OSINT	Saint Bear
OSINT	Lorec53
OSINT	EMBER BEAR
OSINT	Lorec Bear
OSINT	Bleeding Bear
OSINT	Cadet Blizzard
OSINT	DEV-0586

MITRE ATT&CK techniques (18)

T1027.002 T1027.013 T1059 T1059.001 T1059.003 T1059.007 T1112 T1203 T1204.001 T1204.002 T1497 T1553.002 T1566.001 T1583.006 T1589.002 T1608.001 T1684.001 T1685

Indicators of compromise

No IOCs extracted yet from reports naming this actor.

Report timeline

Every report in the Global Intel Library that names SaintBear, newest first. Open any report to see the full analysis with provenance.

No reports in the Lore library name this actor yet.

Threat feed IOCs (0)

Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to SaintBear. Each row shows why it was linked and where it came from.

No feed indicators linked to this actor yet. Feeds are checked every hour.

Public research & publications (19)

Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.

attack.mitre.orghttps://attack.mitre.org/groups/G1031
unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/
microsoft.comhttps://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/
attack.mitre.orghttps://attack.mitre.org/groups/G1003
cisa.govhttps://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf
crowdstrike.comhttps://www.crowdstrike.com/blog/who-is-ember-bear/
mandiant.comhttps://www.mandiant.com/resources/russia-invasion-ukraine-retaliation
malpedia.caad.fkie.fraunhofer.dehttps://malpedia.caad.fkie.fraunhofer.de/details/win.graphsteel
cert.gov.uahttps://cert.gov.ua/article/38374
blog.malwarebytes.comhttps://blog.malwarebytes.com/threat-intelligence/2022/04/new-uac-0056-activity-theres-a-go-elephant-in-the-room/
intezer.comhttps://www.intezer.com/blog/research/elephant-malware-targeting-ukrainian-orgs/
sentinelone.comhttps://www.sentinelone.com/blog/threat-actor-uac-0056-targeting-ukraine-with-fake-translation-software/
unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/atoms/nascentursa/
symantec-enterprise-blogs.security.comhttps://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/nodaria-ukraine-infostealer
blog.googlehttps://blog.google/threat-analysis-group/fog-of-war-how-the-ukraine-conflict-transformed-the-cyber-threat-landscape/
circleid.comhttps://circleid.com/posts/20230412-probing-lorec53-phishing-through-the-dns-microscope
nsfocusglobal.comhttps://nsfocusglobal.com/wp-content/uploads/2021/11/Analysis-Report-on-Lorec53-Group.pdf
crowdstrike.comhttps://www.crowdstrike.com/en-us/blog/who-is-ember-bear/
attack.mitre.orghttps://attack.mitre.org/groups/G1003/