Saint Bear
- ID
- G1031
- Associated names
- Storm-0587, TA471, UAC-0056, Lorec53
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
Saint Bear is a Russian-nexus threat actor active since early 2021, primarily targeting entities in Ukraine and Georgia. The group is notable for a specific remote access tool, Saint Bot, and information stealer, OutSteel in campaigns. Saint Bear typically relies on phishing or web staging of malicious documents and related file types for initial access, spoofing government or related entities.[1][2] Saint Bear has previously been confused with Ember Bear operations, but analysis of behaviors, tools, and targeting indicates these are distinct clusters.
Techniques used (18)
- T1027.002 Software Packing
- T1027.013 Encrypted/Encoded File
- T1059 Command and Scripting Interpreter
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.007 JavaScript
- T1112 Modify Registry
- T1203 Exploitation for Client Execution
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1497 Virtualization/Sandbox Evasion
- T1553.002 Code Signing
- T1566.001 Spearphishing Attachment
- T1583.006 Web Services
- T1589.002 Email Addresses
- T1608.001 Upload Malware
- T1684.001 Impersonation
- T1685 Disable or Modify Tools
Software used (2)
References
- Palo Alto Unit 42 OutSteel SaintBot February 2022
- Cadet Blizzard emerges as novel threat actor