CVE Intelligence
Home / Threat actors / Saint Bear

Saint Bear G1031

🔔 Create alert

Also known as: Storm-0587, TA471, UAC-0056, Lorec53

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

1
associated CVEs
20
Techniques
2
Malware and tools

Saint Bear is a Russian-nexus threat actor active since early 2021, primarily targeting entities in Ukraine and Georgia. The group is notable for a specific remote access tool, Saint Bot, and information stealer, OutSteel in campaigns. Saint Bear typically relies on phishing or web staging of malicious documents and related file types for initial access, spoofing government or related entities. Saint Bear has previously been confused with Ember Bear operations, but analysis of behaviors, tools, and targeting indicates these are distinct clusters.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2017-11882 High · 7.8 KEV Ransomware Microsoft Office Memory Corruption Vulnerability
“Saint Bear has leveraged vulnerabilities in client applications such as CVE-2017-11882 in Microsoft Office to enable code execution in victim environments.”

Techniques by tactic

Reconnaissance
T1589.002 Email Addresses
Resource Development
T1583.006 Web ServicesT1608.001 Upload Malware
Initial Access
T1566.001 Spearphishing Attachment
Execution
T1059 Command and Scripting InterpreterT1059.001 PowerShellT1059.003 Windows Command ShellT1059.007 JavaScriptT1203 Exploitation for Client ExecutionT1204.001 Malicious LinkT1204.002 Malicious File
Persistence
T1112 Modify Registry
Stealth
T1027.002 Software PackingT1027.013 Encrypted/Encoded FileT1497 Virtualization/Sandbox EvasionT1684.001 Impersonation
Defense Impairment
T1112 Modify RegistryT1553.002 Code SigningT1685 Disable or Modify Tools
Discovery
T1497 Virtualization/Sandbox Evasion

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.