SaintBear
Also known as UNC2589, TA471, UAC-0056, Nascent Ursa, Nodaria, FROZENVISTA, Storm-0587, DEV-0587, Saint Bear, Lorec53, EMBER BEAR, Lorec Bear, Bleeding Bear, Cadet Blizzard, DEV-0586
0mentions, 7 days
0mentions, 30 days
nonelast mentioned
A group targeting UA state organizations using the GraphSteel and GrimPlant malware.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
T1003 OS Credential DumpingT1003.001 LSASS MemoryT1003.002 Security Account ManagerT1003.004 LSA SecretsT1005 Data from Local SystemT1018 Remote System DiscoveryT1021 Remote ServicesT1036 MasqueradingT1036.005 Match Legitimate Resource Name or LocationT1046 Network Service DiscoveryT1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059.001 PowerShellT1070.004 File DeletionT1071.004 DNST1078.001 Default AccountsT1090.003 Multi-hop ProxyT1095 Non-Application Layer ProtocolT1110 Brute ForceT1110.003 Password SprayingT1112 Modify RegistryT1114 Email CollectionT1119 Automated CollectionT1125 Video CaptureT1133 External Remote ServicesT1190 Exploit Public-Facing ApplicationT1195 Supply Chain CompromiseT1203 Exploitation for Client ExecutionT1210 Exploitation of Remote ServicesT1491.002 External DefacementT1505.003 Web ShellT1550.002 Pass the HashT1552.001 Credentials In FilesT1560 Archive Collected DataT1561.002 Disk Structure WipeT1567.002 Exfiltration to Cloud StorageT1570 Lateral Tool TransferT1571 Non-Standard PortT1572 Protocol TunnelingT1583 Acquire InfrastructureT1583.003 Virtual Private ServerT1585 Establish AccountsT1588.001 MalwareT1588.005 ExploitsT1595.001 Scanning IP BlocksT1595.002 Vulnerability ScanningT1654 Log Enumeration
Recent activity
No posts or advisories have named this actor recently.
References
- https://malpedia.caad.fkie.fraunhofer.de/details/win.graphsteel
- https://cert.gov.ua/article/38374
- https://blog.malwarebytes.com/threat-intelligence/2022/04/new-uac-0056-activity-theres-a-go-elephant-in-the-room/
- https://www.intezer.com/blog/research/elephant-malware-targeting-ukrainian-orgs/
- https://www.sentinelone.com/blog/threat-actor-uac-0056-targeting-ukraine-with-fake-translation-software/
- https://unit42.paloaltonetworks.com/atoms/nascentursa/
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/nodaria-ukraine-infostealer
- https://blog.google/threat-analysis-group/fog-of-war-how-the-ukraine-conflict-transformed-the-cyber-threat-landscape/
- https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/
- https://circleid.com/posts/20230412-probing-lorec53-phishing-through-the-dns-microscope
- https://nsfocusglobal.com/wp-content/uploads/2021/11/Analysis-Report-on-Lorec53-Group.pdf
- https://www.crowdstrike.com/en-us/blog/who-is-ember-bear/
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.