ClassicBrechasMapaActoresTTP MatrixAnaliticaAlertasCyberNewsArsenalExploitsKillChainOrigenSSLBLRansomLookRansomwhere
SaintBear
0 incidentes
0 paises
0 sectores
apt RU Ultimo: -
Aliases: Bleeding Bear, Cadet Blizzard, DEV-0587, EMBER BEAR, FROZENVISTA, Lorec Bear, Lorec53, Nascent Ursa, Nodaria, Saint Bear, Storm-0587, TA471, UAC-0056, UNC2589, incluyendo brechas de seguridad, ransomware
SaintBear is a Russian-nexus threat actor primarily engaged in cyber espionage and information theft, having emerged in early 2021. The group is known for its precise targeting and extensive reconnaissance, often leveraging custom-built malware and zero-day vulnerabilities. SaintBear operates under numerous aliases, including Storm-0587, TA471, UAC-0056, Lorec53, UNC2589, Nascent Ursa, Nodaria, and FROZENVISTA. While sometimes confused with Ember Bear operations, analysis indicates these are distinct activities. The group's primary motivation is geopolitical espionage, and it distinguishes itself through the use of specific remote access tools like Saint Bot and information stealer OutSteel, as well as a demonstrated capability for destructive attacks involving file corruptors.