Skip to content
Nation-state APTEspionageAdvanced sophistication · State-backed

UAC-0056

UAC-0056 is a Russia-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets 11 sectors, including Government and Technology, in 18 countries, including the United States and the United Kingdom. It uses 87 MITRE ATT&CK techniques and exploits 15 known CVEs.

Also known as
  • Storm-0587
  • TA471
  • Lorec53
  • UNC2589
  • Bleeding Bear
  • DEV-0586
  • Frozenvista
  • Cadet Blizzard
  • Ember Bear
  • Ruinous Ursa
  • Operation “Bleeding Bear”
  • SaintBear
  • Nodaria
  • Nascent Ursa
  • G1003
Origin
Russia
Techniques
87
Exploited CVEs
15
Record updated

Who They Target.

Labelsespionage

About UAC-0056.

Saint Bear is a Russian-nexus threat actor active since early 2021, primarily targeting entities in Ukraine and Georgia. The group is notable for a specific remote access tool, Saint Bot, and information stealer, OutSteel in campaigns.

Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.