SaintBear
No sourced public emblem in this profile.
reference profile · reported nexus: RU (not nationality)
A group targeting UA state organizations using the GraphSteel and GrimPlant malware.
Source-reported aliases: UNC2589, TA471, UAC-0056, Nascent Ursa, Nodaria, FROZENVISTA, Storm-0587, DEV-0587, Saint Bear, Lorec53, EMBER BEAR, Lorec Bear, Bleeding Bear, Cadet Blizzard. Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): No country-level metadata
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://malpedia.caad.fkie.fraunhofer.de/details/win.graphsteel
https://cert.gov.ua/article/38374
https://www.intezer.com/blog/research/elephant-malware-targeting-ukrainian-orgs/
https://unit42.paloaltonetworks.com/atoms/nascentursa/
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/nodaria-ukraine-infostealer
https://circleid.com/posts/20230412-probing-lorec53-phishing-through-the-dns-microscope
https://nsfocusglobal.com/wp-content/uploads/2021/11/Analysis-Report-on-Lorec53-Group.pdf
https://www.crowdstrike.com/en-us/blog/who-is-ember-bear/
https://attack.mitre.org/groups/G1003/