G1031 · 18 ATT&CK techniques · 0 correlated reports

Saint Bear

Aliases: Storm-0587, TA471, UAC-0056, Lorec53

Saint Bear is a Russian-nexus threat actor active since early 2021, primarily targeting entities in Ukraine and Georgia. The group is notable for a specific remote access tool, Saint Bot, and information stealer, OutSteel in campaigns. Saint Bear typically relies on phishing or web staging of malicious documents and related file types for initial access, spoofing government or related entities. Saint Bear has previously been confused with Ember Bear operations, but analysis of behaviors, tools, and targeting indicates these are distinct clusters.

Open interactive actor investigation

ATT&CK techniques

T1566.001
Spearphishing Attachment T1203
Exploitation for Client Execution T1059.007
JavaScript T1589.002
Email Addresses T1497
Virtualization/Sandbox Evasion T1059.003
Windows Command Shell T1553.002
Code Signing T1204.001
Malicious Link T1027.013
Encrypted/Encoded File T1656
Impersonation T1059.001
PowerShell T1204.002
Malicious File T1059
Command and Scripting Interpreter T1583.006
Web Services T1608.001
Upload Malware T1562.001
Disable or Modify Tools T1027.002
Software Packing T1112
Modify Registry

Correlated CTI and IR reports

Continue the investigation

Interactive ThreatMapper ThreatMapper documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas ITDR Handbook 1200km Medium research