Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · SaintBear · Unknown · assessed origin Russia · misp-galaxy + mitre-attack · refreshed 2026-10-06

SaintBear

  • UNC2589
  • TA471
  • UAC-0056
  • Nascent Ursa
  • Nodaria
  • FROZENVISTA
  • Storm-0587
  • DEV-0587

MITRE G1003 ↗

SaintBear — ATT&CK roseSA

attack rose · 47 techniques across 14 tactics

Analyst brief

misp-galaxy + mitre-attack

A group targeting UA state organizations using the GraphSteel and GrimPlant malware.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

47 techniques · 14 of 15 tactics

  1. Reconnaissance

    2 techniques

  2. Resource development

    5 techniques

  3. Initial access

    2 techniques

  4. Execution

    4 techniques

  5. Persistence

    2 techniques

  6. Stealth

    4 techniques

  7. Defense impairment

    1 technique

  8. Credential access

    7 techniques

  9. Discovery

    3 techniques

  10. Lateral movement

    4 techniques

  11. Collection

    5 techniques

  12. Command and control

    5 techniques

  13. Exfiltration

    1 technique

  14. Impact

    2 techniques

select a technique

Arsenal

4 malware · 7 tools
Malware
Malware · 4ATT&CK
P.A.S. WebshellS0598 ↗
reGeorgS1187 ↗
WhisperGateS0689 ↗
Saint BotS1018 ↗
Tools
Tools · 7ATT&CK
CrackMapExecS0488 ↗
ResponderS0174 ↗
ngrokS0508 ↗
PsExecS0029 ↗
RcloneS1040 ↗
BloodHoundS0521 ↗
ImpacketS0357 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs SaintBear is cited as exploiting

none on KEV
  1. CVE-2022-410402026-10-17
    1. “Cadet Blizzard is also known for exploiting Confluence servers through the CVE-2021-26084 vulnerability, Exchange servers through multiple vulnerabilities including CVE-2022-41040 and ProxyShell”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

    2. “Ember Bear gains initial access to victim environments by exploiting external-facing services. Examples include exploitation of CVE-2021-26084 in Confluence servers; CVE-2022-41040, ProxyShell, and other vulnerabilities in Microsoft Exchange”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  2. CVE-2021-260842026-10-17
    1. “Cadet Blizzard is also known for exploiting Confluence servers through the CVE-2021-26084 vulnerability, Exchange servers through multiple vulnerabilities including CVE-2022-41040 and ProxyShell”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

    2. “Ember Bear gains initial access to victim environments by exploiting external-facing services. Examples include exploitation of CVE-2021-26084 in Confluence servers; CVE-2022-41040, ProxyShell, and other vulnerabilities in Microsoft Exchange”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  3. CVE-2017-118822026-10-17
    1. “Saint Bear has leveraged vulnerabilities in client applications such as CVE-2017-11882 in Microsoft Office to enable code execution in victim environments.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

    2. “The document named Letter Confirm.doc is a CVE-2017-11882 vulnerability document, and the following content is displayed after opening:”

      cited as exploiting · named nearby · source: nsfocusglobal.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2022Cyber attack of UAC-0056 group on state organizations of Ukraine using malicious programs SaintBot and OutSteel (CERT-UA #3799)CERT-UA ↗
  2. 2022APT Group LOREC53 (Lori Bear) Recently Launched A Large-Scale Cyber Attack On Ukrainensfocus ↗
  3. 2022Threat Actor UAC-0056 Targeting Ukraine with Fake Translation SoftwareSentinelone ↗
  4. 2022UAC-0056 cyberattack on Ukrainian authorities using GraphSteel and GrimPlant malwareCERT_UA ↗

Take it with you

keyless · no signup

References

19 sources
  1. 1.malpedia.caad.fkie.fraunhofer.de/details/win.graphsteel
  2. 2.cert.gov.ua/article/38374
  3. 3.blog.malwarebytes.com/threat-intelligence/2022/04/new-uac-0056-activity-ther…
  4. 4.intezer.com/blog/research/elephant-malware-targeting-ukrainian-orgs
  5. 5.sentinelone.com/blog/threat-actor-uac-0056-targeting-ukraine-with-fake…
  6. 6.unit42.paloaltonetworks.com/atoms/nascentursa
  7. 7.symantec-enterprise-blogs.security.com/blogs/threat-intelligence/nodaria-ukraine-infostealer
  8. 8.blog.google/threat-analysis-group/fog-of-war-how-the-ukraine-confl…
  9. 9.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-…
  10. 10.circleid.com/posts/20230412-probing-lorec53-phishing-through-the-dn…
  11. +9 more in the JSON record

Track SaintBear on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.