SaintBearThreat actor
- Bleeding Bear
- cadet blizzard
- dev-0586
- dev-0587
- ember bear
- frozenvista
- lorec bear
- lorec53
- nascent ursa
- nodaria
- ruinous ursa
- saint bear
- storm-0587
- ta471
- UAC-0056
- unc2589
A group targeting UA state organizations using the GraphSteel and GrimPlant malware.From MISP Galaxy
Last reported 28 days ago, by SOCRadar3 reports
ATT&CK techniques
6 of 27 · each with the sentence it comes from- T1003.001LSASS Memory
“T1003.001 LSASS Memory”
- T1036Masquerading
“Hunt for Sliver implant indicators, including process masquerading and beacon traffic to 46.8.236.121:11008 / 11009 at 60-second mTLS check-in intervals.”
- T1021.006Windows Remote Management
“T1021.006 WinRM”
- T1027Obfuscated Files or Information
“T1027 - Obfuscated Files or Information”
- T1047Windows Management Instrumentation
“T1047 - Windows Management Instrumentation”
- T1053.005Scheduled Task
“Scheduled Task Execution”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Operation Talked: A Russia-Linked Cyber Espionage Campaign Targeting Ukraine’s Defense Industry“SOCRadar attributes this activity to a Russia-nexus actor with high confidence, based on TTP overlap with UAC-0056 / UAC-0114, Moscow-timezone activity, and Russian-language artifacts the actor left in their own shell history.”
-
Operation Bleeding Bear“Operation Bleeding Bear”
-
Elastic protects against data wiper malware targeting Ukraine: HERMETICWIPER“Elastic previously published research on Operation Bleeding Bear, a campaign targeted towards Ukrainian assets with similar destructive intentions.”
Indicators in its reports
named in the reports above- process[.]pein 1 report
- 111.111.111[.]111in 1 report
- a196c6b8ffcb97ff…f56f36a38e92in 1 report
- dcbbae5a1c61dbbb…9384081c9b78in 1 report
- 34ca75a8c190f20b…5b61ac7ea907in 1 report
- 923eb77b3c9e11d6…eeb73d1accd6in 1 report
- 9ef7dbd3da51332a…a07d716d892din 1 report
- 1bc44eef75779e3c…f6928d292591in 1 report
- 0385eeab00e946a3…450f5ece21dain 1 report
- 3c557727953a8f6b…dd02615b1767in 1 report
- 2c10b2ec0b995b88…6ecf53adf5bfin 1 report
- hxxps://opencorporates[.]com/companies/cy/HE419469in 1 report
- opencorporates[.]comin 1 report
- hxxps://www.easeus[.]com/partition-managerin 1 report
- www.easeus[.]comin 1 report
Copy these 15 indicators · defanged
Thanks — we review every report.