SaintBear

🇷🇺Russia-attributed

aliases

Last seen:May 20, 2026

Intelligence Profile

A group targeting UA state organizations using the GraphSteel and GrimPlant malware.

Threat Analysis

SaintBear is a known-sophistication threat actor attributed to Russia, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://malpedia.caad.fkie.fraunhofer.de/details/win.graphsteel

→https://cert.gov.ua/article/38374

→https://blog.malwarebytes.com/threat-intelligence/2022/04/new-uac-0056-activity-theres-a-go-elephant-in-the-room/

→https://www.intezer.com/blog/research/elephant-malware-targeting-ukrainian-orgs/

→https://www.sentinelone.com/blog/threat-actor-uac-0056-targeting-ukraine-with-fake-translation-software/

→https://unit42.paloaltonetworks.com/atoms/nascentursa/

→https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/nodaria-ukraine-infostealer

→https://blog.google/threat-analysis-group/fog-of-war-how-the-ukraine-conflict-transformed-the-cyber-threat-landscape/

→https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/

→https://circleid.com/posts/20230412-probing-lorec53-phishing-through-the-dns-microscope

Quick Facts

TypeAPT / Threat Group

Origin🇷🇺 Russia

Aliases15

SourceMalpedia

Also Known As

UAC-0056NodariaNascent UrsaEMBER BEARStorm-0587UNC2589SaintBearLorec53Lorec BearDEV-0587Cadet BlizzardSaint BearTA471Bleeding BearFROZENVISTA

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search SaintBear