Skip to content
brandefense.io
Request A Demo
Nation-state APTEspionageAdvanced sophistication · State-backed

Saint Bear

Saint Bear is a Russia-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets 11 sectors, including Government and Technology, in 18 countries, including the United States and India. It uses 87 MITRE ATT&CK techniques and exploits 15 known CVEs.

Also known as
  • Storm-0587
  • TA471
  • Lorec53
  • UNC2589
  • Bleeding Bear
  • DEV-0586
  • Frozenvista
  • Cadet Blizzard
  • Ember Bear
  • Ruinous Ursa
  • Operation “Bleeding Bear”
  • Nodaria
  • Nascent Ursa
  • G1003
  • UAC-0056
Request IOC feedRequest ATT&CK export
Origin
Russia
Techniques
87
Exploited CVEs
15
First seen
Mar 1, 2021
Last seen
Feb 1, 2023
Record updated

Who They Target.

Sectors · 11
Countries · 18
Labelsespionage

How They Operate · MITRE ATT&CK.

87 techniques across 15 of 16 tactics

Reconnaissance12

T1012
Query Registry
T1046
Network Service Discovery
T1057
Process Discovery
T1082
System Information Discovery
T1497
Virtualization/Sandbox Evasion
T1585
Establish Accounts
T1589.002
Gather Victim Identity Information: Email Addresses
T1590.002
Gather Victim Network Information: DNS
T1595
Active Scanning
T1595.001
Active Scanning: Scanning IP Blocks
T1595.002
Active Scanning: Vulnerability Scanning
T1596.005
Search Open Technical Databases: Scan Databases

Resource Development8

T1583
Acquire Infrastructure
T1583.003
Acquire Infrastructure: Virtual Private Server
T1583.006
Acquire Infrastructure: Web Services
T1588.001
Obtain Capabilities: Malware
T1588.002
Obtain Capabilities: Tool
T1588.003
Obtain Capabilities: Code Signing Certificates
T1588.005
Obtain Capabilities: Exploits
T1608.001
Stage Capabilities: Upload Malware

Initial Access16

T1078
Valid Accounts
T1078.001
Valid Accounts: Default Accounts
T1110
Brute Force
T1110.003
Brute Force: Password Spraying
T1133
External Remote Services
T1190
Exploit Public-Facing Application
T1195
Supply Chain Compromise
T1203
Exploitation for Client Execution
T1204.001
User Execution: Malicious Link
T1204.002
User Execution: Malicious File
T1210
Exploitation of Remote Services
T1505.003
Server Software Component: Web Shell
T1560
Archive Collected Data
T1566
Phishing
T1566.001
Phishing: Spearphishing Attachment
T1566.002
Phishing: Spearphishing Link

Execution11

T1021
Remote Services
T1047
Windows Management Instrumentation
T1053.005
Scheduled Task/Job: Scheduled Task
T1059
Command and Scripting Interpreter
T1059.001
Command and Scripting Interpreter: PowerShell
T1059.003
Command and Scripting Interpreter: Windows Command Shell
T1059.007
Command and Scripting Interpreter: JavaScript
T1105
Ingress Tool Transfer
T1119
Automated Collection
T1485
Data Destruction
T1570
Lateral Tool Transfer

Persistence4

T1112
Modify Registry
T1137.001
Office Application Startup: Office Template Macros
T1543.003
Create or Modify System Process: Windows Service
T1550.002
Use Alternate Authentication Material: Pass the Hash

Privilege Escalation1

T1134
Access Token Manipulation

Defense Evasion16

T1027
Obfuscated Files or Information
T1027.001
Obfuscated Files or Information: Binary Padding
T1027.002
Obfuscated Files or Information: Software Packing
T1027.010
Obfuscated Files or Information: Command Obfuscation
T1027.013
Obfuscated Files or Information: Encrypted/Encoded File
T1036
Masquerading
T1036.005
Masquerading: Match Legitimate Resource Name or Location
T1070.004
Indicator Removal: File Deletion
T1090.003
Proxy: Multi-hop Proxy
T1102
Web Service
T1218.002
System Binary Proxy Execution: Control Panel
T1552.001
Unsecured Credentials: Credentials In Files
T1553.002
Subvert Trust Controls: Code Signing
T1562.001
Impair Defenses: Disable or Modify Tools
T1572
Protocol Tunneling
T1656
Impersonation

Credential Access4

T1003
OS Credential Dumping
T1003.001
OS Credential Dumping: LSASS Memory
T1003.002
OS Credential Dumping: Security Account Manager
T1003.004
OS Credential Dumping: LSA Secrets

Discovery5

T1007
System Service Discovery
T1018
Remote System Discovery
T1083
File and Directory Discovery
T1125
Video Capture
T1654
Log Enumeration

Lateral Movement·

Collection2

T1005
Data from Local System
T1114
Email Collection

Command and Control3

T1071.004
Application Layer Protocol: DNS
T1095
Non-Application Layer Protocol
T1571
Non-Standard Port

Exfiltration1

T1567.002
Exfiltration Over Web Service: Exfiltration to Cloud Storage

Impact2

T1491.002
Defacement: External Defacement
T1561.002
Disk Wipe: Disk Structure Wipe

Defense Impairment1

T1685
Disable or Modify Tools

Stealth1

T1684.001
Social Engineering: Impersonation

Vulnerabilities They Exploit.

Browse Vulnerability Intelligence →
CVE-2021-26084Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthenticated attacker to execute code.ExploitedcriticalCVE-2021-33044Dahua IP cameras and related products contain an authentication bypass vulnerability when the NetKeyboard type argument is specified by the client during authentication.ExploitedcriticalCVE-2021-33045Dahua IP cameras and related products contain an authentication bypass vulnerability when the loopback device is specified by the client during authentication.ExploitedcriticalCVE-2022-26134Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code execution.ExploitedcriticalCVE-2022-26138Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext.ExploitedcriticalCVE-2022-3236A code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows for remote code execution.ExploitedcriticalCVE-2021-34473Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution.ExploitedcriticalCVE-2021-34523Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.ExploitedcriticalCVE-2022-41040Microsoft Exchange Server allows for server-side request forgery.ExploitedhighCVE-2022-41082Microsoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote code execution.Exploitedhigh

43 more vulnerabilities on the Brandefense platform

Exploitation status, severity and linked malware for every CVE

Request A Demo

Arsenal · Malware And Tools.

  • Cobalt Strikemalware
  • Graphironmalware
  • GraphSteelmalware
  • GrimPlantmalware
  • OutSteelmalware
  • P.A.S. Webshellmalware
  • p0wnyshellmalware
  • Raspberry Robinmalware
  • reGeorgmalware
  • Saint Botmalware
  • WhisperGatemalware
  • BloodHoundtool
  • CrackMapExectool
  • GOSTtool
  • Impackettool
  • LOLBinstool
  • Netcattool
  • ngroktool
  • PsExectool
  • Rclonetool
  • Respondertool

Campaigns.

  1. UAC-0056 defacement of Ukrainian government websites via 2021 web shells (2023-02)Dec 2021 to Feb 2023
  2. Nodaria Graphiron infostealer attacks on Ukraine (2022-10)Oct 2022 to Jan 2023
  3. UAC-0056 humanitarian-report spreadsheet phishing against Polish government (2022-07)Jul 2022
  4. Nascent Ursa activity 2021-03 to 2022-02Mar 2021 to Feb 2022
  5. Ruinous Ursa: WhisperGate malware targeting UkraineJan 2022

Indicators Of Compromise.

TLP:AMBER
  • Hash04a74594c9227aab6b6a39b7dc4ec1425c1799ccc808018c818212f23ec1d1c2
  • Domainjusticeua[.]org

45 more indicators on the Brandefense platform

IP, domain and hash indicators · YARA rules · ATT&CK Navigator export

Request A Demo

About Saint Bear.

Saint Bear is a Russian-nexus threat actor active since early 2021, primarily targeting entities in Ukraine and Georgia. The group is notable for a specific remote access tool, Saint Bot, and information stealer, OutSteel in campaigns.

Last updated Nov 3, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.