Saint Bear

G1031 Lorec53 Storm-0587 TA471 UAC-0056

▲ High Threat

Edge Device Exploitation Campaign, Stealthy Persistence via LotL

Origin China

Sponsor China

Motivation Espionage and intelligence gathering

Target Sectors

Government Telecommunications Defense Critical Infrastructure Technology

Exploitation of Public-Facing Applications

Living off the Land (LotL)

Credential Access

Lateral Movement

Persistence via Web Shells

Bypassing Multi-Factor Authentication (MFA)

CISA Advisories ↗

Hacking the mainframe…