SaintBear

▲ High Threat Russia

Primary Aliases: Bleeding Bear Cadet Blizzard DEV-0586 DEV-0587

Confidence Rating 70% (Grounded)

A group targeting UA state organizations using the GraphSteel and GrimPlant malware.

🎯 Target Sectors & Focus

Defense & Aerospace Government & Diplomacy Financial & Crypto Critical Infrastructure

🛡️ MITRE ATT&CK® Attack Lifecycle (6 TTPs)

📥 Download Navigator JSON

Initial Access 1

T1566 Exploitation of Public-Facing Applications

Persistence & Privilege Escalation 1

T1547 Persistence via Web Shells

Credential Access & Discovery 1

T1003 Credential Access

Lateral Movement & Collection 1

T1021 Lateral Movement

Operational Techniques 2

T1000 Living off the Land (LotL)

T1000 Bypassing Multi-Factor Authentication (MFA)

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

[DEEP DIVE] Star Blizzard Scales Phishing Operations with RedFlick Malware Delivery

Strategies and Tactics 2026-10-03

Copied to clipboard

LINK COPIED TO CLIPBOARD