MITRE ATT&CKgroup
G1031 Saint Bear
- Domain
- enterprise
- Aliases
- Storm-0587, TA471, UAC-0056, Lorec53
- Version
- 1.0
- Created
- 2024-05-25
Description
Saint Bear is a Russian-nexus threat actor active since early 2021, primarily targeting entities in Ukraine and Georgia. The group is notable for a specific remote access tool, Saint Bot, and information stealer, OutSteel in campaigns. Saint Bear typically relies on phishing or web staging of malicious documents and related file types for initial access, spoofing government or related entities. Saint Bear has previously been confused with Ember Bear operations, but analysis of behaviors, tools, and targeting indicates these are distinct clusters.
Related
Uses · MITRE ATT&CK (20)
- T1684.001 Impersonation sub-technique
- T1685 Disable or Modify Tools technique
- T1027.013 Encrypted/Encoded File sub-technique
- S1017 OutSteel software (malware)
- S1018 Saint Bot software (malware)
- T1608.001 Upload Malware sub-technique
- T1589.002 Email Addresses sub-technique
- T1583.006 Web Services sub-technique
- T1059.007 JavaScript sub-technique
- T1204.001 Malicious Link sub-technique
- T1204.002 Malicious File sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1027.002 Software Packing sub-technique
- T1553.002 Code Signing sub-technique
- T1497 Virtualization/Sandbox Evasion technique
- T1203 Exploitation for Client Execution technique
- T1059 Command and Scripting Interpreter technique
- T1112 Modify Registry technique
References
- https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/ Cadet Blizzard emerges as novel threat actor
- https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/ Palo Alto Unit 42 OutSteel SaintBot February 2022