SaintBear

ACTIVE CAMPAIGN TRACKED ▲ High Threat Russia

Primary Aliases: Bleeding Bear Cadet Blizzard DEV-0586 DEV-0587

Sponsor / State Affiliation Russian Federation (Intelligence Services)

Primary Motivation Espionage and Intelligence Collection

Confidence Rating 90% (Grounded)

UK Government and Diplomatic Espionage, International NGO and Think Tank Compromise

🎯 Target Sectors & Focus

Government agencies Diplomatic missions Non-Governmental Organizations (NGOs) Think tanks Political organizations NATO-aligned entities

🛡️ MITRE ATT&CK® Attack Lifecycle (6 TTPs)

📥 Download Navigator JSON

Initial Access 2

T1566 Spear-phishing via highly tailored emails

T1566 OAuth device code phishing

Persistence & Privilege Escalation 1

T1547 Account takeover (ATO) via session/token theft

Credential Access & Discovery 1

T1003 Credential harvesting through deceptive login pages

Operational Techniques 2

T1000 Abuse of legitimate cloud services (Microsoft 365, OneDrive)

T1000 Malicious URL redirection to compromised legitimate sites

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

[DEEP DIVE] Star Blizzard Scales Phishing Operations with RedFlick Malware Delivery

Strategies and Tactics 2026-10-03

Copied to clipboard

LINK COPIED TO CLIPBOARD