Saint Bear

MITRE ATT&CK: G1031 View on attack.mitre.org

Aliases: Storm-0587, TA471, UAC-0056, Lorec53, Saint Bear

First seen
2021-01-01 00:00:00
Primary motivation
espionage
Sophistication
advanced
Resource level
government
Actor type
nation-state
Profile updated
2026-07-07 12:01:33

Targeted industries: government-and-public-sector energy-and-utilities

Targeted regions: country_code:ua country_code:ge

Context

Saint Bear is a Russian-nexus threat actor active since early 2021, primarily targeting entities in Ukraine and Georgia. The group is notable for a specific remote access tool, Saint Bot, and information stealer, OutSteel in campaigns. Saint Bear typically relies on phishing or web staging of malicious documents and related file types for initial access, spoofing government or related entities. Saint Bear has previously been confused with Ember Bear operations, but analysis of behaviors, tools, and targeting indicates these are distinct clusters.

Detection coverage

  • 607 Sigma rules

Malware & tools used

  • Spearphishing Attachment (attack-pattern)
  • Exploitation for Client Execution (attack-pattern)
  • JavaScript (attack-pattern)
  • Email Addresses (attack-pattern)
  • Virtualization/Sandbox Evasion (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • Code Signing (attack-pattern)
  • Malicious Link (attack-pattern)
  • Encrypted/Encoded File (attack-pattern)
  • Disable or Modify Tools (attack-pattern)
  • Impersonation (attack-pattern)
  • PowerShell (attack-pattern)
  • Malicious File (attack-pattern)
  • Command and Scripting Interpreter (attack-pattern)
  • Web Services (attack-pattern)
  • Upload Malware (attack-pattern)
  • Software Packing (attack-pattern)
  • Modify Registry (attack-pattern)
  • Saint Bot (malware)
  • OutSteel (malware)

Reports & references

  • Microsoft — Cadet Blizzard Emerges As A Novel And Distinct Russian Threat Actor (report)
  • Palo Alto Unit 42 — Ukraine Targeted Outsteel Saintbot (report)
  • MITRE ATT&CK — G1031 (report)

External references