What other aliases and vendor names is Saint Bear known by?

Saint Bear is tracked across the cybersecurity industry by multiple aliases, including: Bleeding Bear, Blue Callisto, BlueCharlie, Cadet Blizzard, Callisto, Callisto Group, COLD RELIC, COLDRIVER.

What are the primary motivations and sponsors of Saint Bear?

Saint Bear operates from China with primary motivation categorized as Espionage and intelligence gathering, sponsored or affiliated with China.

Saint Bear

ACTIVE CAMPAIGN TRACKED ▲ High Threat China

Primary Aliases: Bleeding Bear Cadet Blizzard DEV-0586 DEV-0587

Sponsor / State Affiliation China

Primary Motivation Espionage and intelligence gathering

Confidence Rating 85% (Grounded)

Edge Device Exploitation Campaign, Stealthy Persistence via LotL

🎯 Target Sectors & Focus

Government Telecommunications Defense Critical Infrastructure Technology

🛡️ MITRE ATT&CK® Attack Lifecycle (6 TTPs)

📥 Download Navigator JSON

Initial Access 1

T1566 Exploitation of Public-Facing Applications

↗

Persistence & Privilege Escalation 1

T1547 Persistence via Web Shells

↗

Credential Access & Discovery 1

T1003 Credential Access

↗

Lateral Movement & Collection 1

T1021 Lateral Movement

↗

Operational Techniques 2

T1000 Living off the Land (LotL)

↗

T1000 Bypassing Multi-Factor Authentication (MFA)

↗

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

[DEEP DIVE] Star Blizzard Scales Phishing Operations with RedFlick Malware Delivery

Strategies and Tactics 2026-10-03

Copied to clipboard

LINK COPIED TO CLIPBOARD

Saint Bear

🎯 Target Sectors & Focus

🛡️ MITRE ATT&CK® Attack Lifecycle (6 TTPs)

📰 Verified Campaigns & Intelligence Archive

SHARE INTELLIGENCE WIRE