Saint Bear

Overview

Saint Bear is a Russian-nexus threat actor active since early 2021, primarily targeting entities in Ukraine and Georgia. The group is notable for a specific remote access tool, Saint Bot, and information stealer, OutSteel in campaigns. Saint Bear typically relies on phishing or web staging of malicious documents and related file types for initial access, spoofing government or related entities. Saint Bear has previously been confused with Ember Bear operations, but analysis of behaviors, tools, and targeting indicates these are distinct clusters.

Naming & attribution

Saint Bear is tracked under 5 names across the industry. It uses 18 documented ATT&CK techniques — more than 50% of the 174 groups tracked here.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

• T1497 Virtualization/Sandbox Evasion — used by 3 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• TA505 — 12 shared techniques (30% overlap)
• Elderwood China — 6 shared techniques (29% overlap)
• LazyScripter — 8 shared techniques (27% overlap)
• TA2541 — 9 shared techniques (24% overlap)
• EXOTIC LILY — 6 shared techniques (22% overlap)
• Gorgon Group Pakistan — 6 shared techniques (21% overlap)

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1203

TTPs — 18 techniques across 6 tactics

Tools & malware (2)

OutSteel · Saint Bot

Reporting (2)

• Cadet Blizzard emerges as a novel and distinct Russian threat actor — Microsoft Threat Intelligence
• Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot — Unit 42