SaintBear
threat actorRU01
also known as
Other names and identifiers for this entity.
ATT&CK
Bleeding Bear · Cadet Blizzard · DEV-0586 · Ember Bear · Frozenvista · UAC-0056 · UNC2589
MISP
Bleeding Bear · Cadet Blizzard · DEV-0587 · EMBER BEAR · FROZENVISTA · Lorec Bear · Lorec53 · Nascent Ursa · Nodaria · SaintBear · Storm-0587 · TA471 · UAC-0056 · UNC2589
A group targeting UA state organizations using the GraphSteel and GrimPlant malware.
02
resolved ATT&CK groups
Threat groups associated with this.
03
techniques used (47)
ATT&CK techniques this enables or maps to.
showing 20 of 47
04
software used (11)
Malware and tools associated with this.
05
references
External citations — patches, advisories, analysis.
- https://malpedia.caad.fkie.fraunhofer.de/details/win.graphsteel
- https://cert.gov.ua/article/38374
- https://blog.malwarebytes.com/threat-intelligence/2022/04/new-uac-0056-activity-theres-a-go-elephant-in-the-room/
- https://www.intezer.com/blog/research/elephant-malware-targeting-ukrainian-orgs/
- https://www.sentinelone.com/blog/threat-actor-uac-0056-targeting-ukraine-with-fake-translation-software/
- https://unit42.paloaltonetworks.com/atoms/nascentursa/
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/nodaria-ukraine-infostealer
- https://blog.google/threat-analysis-group/fog-of-war-how-the-ukraine-conflict-transformed-the-cyber-threat-landscape/