Saint Bear

Summary

Russia-nexus espionage cluster active since early 2021 against Ukrainian and Georgian government, energy and military targets (MITRE G1031; Unit 42 SaintBear, Proofpoint TA471, CERT-UA UAC-0056, Symantec Nodaria, Microsoft Storm-0587). Relies on spoofed-government phishing with macro documents and web-staged files that drop its own downloaders and stealers: Saint Bot and OutSteel (Feb 2022 attack on a Ukrainian energy organisation, Unit 42), GraphSteel and GrimPlant (Mar 2022 'salary arrears' lures, CERT-UA) and the Graphiron stealer (Oct 2022–Jan 2023, Symantec). Often conflated with Ember Bear / Cadet Blizzard (GRU unit 29155); MITRE and Microsoft treat the two as distinct clusters, and no government has attributed Saint Bear to a specific service.

Attribution

No specific service named

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• MITRE ATT&CK (MITRE ATT&CK, 2026-10)
  Russian-nexus actor targeting Ukraine and Georgia

Campaigns 3

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 5

Malware and tools 6

Exploited vulnerabilities 1

Highest CVSS first.

Infrastructure patterns

• Discord content-delivery network used to host the malicious content linked from its emails (MITRE ATT&CK, 2026)

Reporting and advisories 4

• Unit 42
  Spear phishing attacks target organizations in Ukraine (OutSteel, SaintBot)
• Symantec
  Graphiron: new Russian information-stealing malware deployed against Ukraine
• CERT-UA
  UAC-0056: GraphSteel and GrimPlant (CERT-UA#4293)
• MITRE ATT&CK
  Saint Bear (G1031) group profile