SaintBear is a Russian-nexus threat actor primarily engaged in cyber espionage and information theft, having emerged in early 2021. The group is known for its precise targeting and extensive reconnaissance, often leveraging custom-built malware and zero-day vulnerabilities. SaintBear operates under numerous aliases, including Storm-0587, TA471, UAC-0056, Lorec53, UNC2589, Nascent Ursa, Nodaria, and FROZENVISTA. While sometimes confused with Ember Bear operations, analysis indicates these are distinct activities. The group's primary motivation is geopolitical espionage, and it distinguishes itself through the use of specific remote access tools like Saint Bot and information stealer OutSteel, as well as a demonstrated capability for destructive attacks involving file corruptors.

Aliases del actor

Bleeding BearCadet BlizzardDEV-0587EMBER BEARFROZENVISTALorec BearLorec53Nascent UrsaNodariaSaint BearStorm-0587TA471UAC-0056UNC2589incluyendo brechas de seguridadransomware

Actores similares

ember-bearactor · 1Saint Bearthreat-actor · 1Ember Bearthreat-actor · 0energetic-bearactor · 1APT29 (Cozy Bear)actor · 1Energetic Bearapt · 0Boulder Bearapt · 0Pat Bearapt · 0White Bearapt · 0Group Space Bearsransomware · 0