G1031
Saint Bear is a Russian-nexus threat actor active since early 2021, primarily targeting entities in Ukraine and Georgia. The group is notable for a specific remote access tool, Saint Bot, and information stealer, OutSteel in campaigns. Saint Bear typically relies on phishing or web staging of malicious documents and related file types for initial access, spoofing government or related entities. Saint Bear has previously been confused with Ember Bear operations, but analysis of behaviors, tools, and targeting indicates these are distinct clusters.
A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.
MITRE notes historical confusion between these names but assesses Saint Bear and Ember Bear as distinct activity clusters.
HighReviewed identity mapping approved on this date.
Reviewed identity mapping approved on this date.
Reviewed identity mapping approved on this date.
Reviewed identity mapping approved on this date.
Reviewed identity mapping approved on this date.
Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.
Every exact-name collision is reviewed. Same-actor decisions select a preferred profile while distinct and unresolved clusters remain separate.
MITRE states that Saint Bear was previously confused with Ember Bear but that behavior, tooling, and targeting indicate distinct activity clusters.
Loading CVEs, techniques, indicators, malware, victims, and activity...