A group targeting UA state organizations using the GraphSteel and GrimPlant malware....

Threat Actor Profile

SaintBear

State-sponsored threat group originating from RU.

Real-Time Alerts

Actor Overview

Origin Country
RU

Related Threat Reports

Premium
APT Campaign Analysis - Q4 2025Dec 2025
New Tactics Observed in WildDec 2025
Infrastructure Mapping ReportDec 2025
Stay Updated

Get alerts when new intel on SaintBear is published.

Actor Details

Primary Name
SaintBear
Known Aliases
UNC2589, TA471, UAC-0056, Nascent Ursa, Nodaria, FROZENVISTA, Storm-0587, DEV-0587, Saint Bear, Lorec53, EMBER BEAR, Lorec Bear, Bleeding Bear
Data Source
Precursor Intelligence
Need API Access?

Integrate threat actor data into your SIEM or SOAR.

View Plans →