RUG1003
SaintBearSaintBear
Also known as: UNC2589 · TA471 · UAC-0056 · Nascent Ursa · Nodaria · FROZENVISTA · Storm-0587 · DEV-0587 · Saint Bear · Lorec53 · EMBER BEAR · Lorec Bear · Bleeding Bear · Cadet Blizzard · SaintBear
Origin
RU
Known aliases
15
Profile
SaintBear is a Russian-attributed threat actor catalogued by MISP-Galaxy (MISP-Galaxy v341). The group is also tracked as UNC2589, TA471, UAC-0056 (and 11 more). Original record: A group targeting UA state organizations using the GraphSteel and GrimPlant malware.
Aliases· 15
UNC2589TA471UAC-0056Nascent UrsaNodariaFROZENVISTAStorm-0587DEV-0587Saint BearLorec53EMBER BEARLorec BearBleeding BearCadet BlizzardSaintBear
MITRE ATT&CK Group crosswalk
References
- https://malpedia.caad.fkie.fraunhofer.de/details/win.graphsteel
- https://cert.gov.ua/article/38374
- https://blog.malwarebytes.com/threat-intelligence/2022/04/new-uac-0056-activity-theres-a-go-elephant-in-the-room/
- https://www.intezer.com/blog/research/elephant-malware-targeting-ukrainian-orgs/
- https://www.sentinelone.com/blog/threat-actor-uac-0056-targeting-ukraine-with-fake-translation-software/
- https://unit42.paloaltonetworks.com/atoms/nascentursa/
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/nodaria-ukraine-infostealer
- https://blog.google/threat-analysis-group/fog-of-war-how-the-ukraine-conflict-transformed-the-cyber-threat-landscape/
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.