Saint Bear
IntrusionSet · ATTACK:enterprise:G1031
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G1031",
"title": "Saint Bear",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G1031",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--674582ec-51c4-42ce-b409-797239e37a2a",
"external_id": "G1031",
"domain": "enterprise",
"created": "2024-05-25T16:11:54.881Z",
"modified": "2026-07-31T18:47:59.664Z",
"version": "1.0",
"aliases": [
"Saint Bear",
"Storm-0587",
"TA471",
"UAC-0056",
"Lorec53"
],
"tactics": [
],
"source_references": [
{
"source_name": "Storm-0587"
},
{
"source_name": "TA471"
},
{
"source_name": "UAC-0056"
},
{
"source_name": "Lorec53"
},
{
"source_name": "Cadet Blizzard emerges as novel threat actor",
"url": "https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"
},
{
"source_name": "Palo Alto Unit 42 OutSteel SaintBot February 2022 ",
"url": "https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"
}
]
}Explicit source assertions (20)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1031 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--06957b67-183f-4320-94ca-15a138382323
Palo Alto Unit 42 OutSteel SaintBot February 2022ATTACK:enterprise:G1031 → uses → ATTACK:enterprise:T1203
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0e1a58e9-06e9-4ad5-8445-4068e240e3d7
Palo Alto Unit 42 OutSteel SaintBot February 2022ATTACK:enterprise:G1031 → uses → ATTACK:enterprise:S1017
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1238411a-1012-470d-af86-8bad2e3e709c
Palo Alto Unit 42 OutSteel SaintBot February 2022ATTACK:enterprise:G1031 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1884086e-4ea7-4e8d-b81a-14471eab6ee5
Palo Alto Unit 42 OutSteel SaintBot February 2022ATTACK:enterprise:G1031 → uses → ATTACK:enterprise:T1589.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1c9ee6d6-b619-469f-8a61-d8514dc2ee31
Palo Alto Unit 42 OutSteel SaintBot February 2022ATTACK:enterprise:G1031 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e42c88d-1513-445c-ae63-7d2a1840753f
Palo Alto Unit 42 OutSteel SaintBot February 2022ATTACK:enterprise:G1031 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f1861d0-00dc-4b68-aab6-0a2f781b3a94
Palo Alto Unit 42 OutSteel SaintBot February 2022ATTACK:enterprise:G1031 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--319cb374-b991-483f-b6d9-e315c333e751
Palo Alto Unit 42 OutSteel SaintBot February 2022ATTACK:enterprise:G1031 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--324a3d54-b9e5-4982-825d-87d281c07544
Cadet Blizzard emerges as novel threat actor · Palo Alto Unit 42 OutSteel SaintBot February 2022ATTACK:enterprise:G1031 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3c91f0ec-8944-43d8-9b55-153a4c031c44
Palo Alto Unit 42 OutSteel SaintBot February 2022ATTACK:enterprise:G1031 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--59af5f32-5099-48cd-bf84-73ab69ef052d
Palo Alto Unit 42 OutSteel SaintBot February 2022ATTACK:enterprise:G1031 → uses → ATTACK:enterprise:T1684.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--61035d89-bac7-4267-829f-a898eeb41f11
Cadet Blizzard emerges as novel threat actorATTACK:enterprise:G1031 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6c740f17-8419-4ee0-95ee-71b4ef5ab35b
Palo Alto Unit 42 OutSteel SaintBot February 2022ATTACK:enterprise:G1031 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--80f3d913-d317-4531-9fb5-293f023f9b11
Palo Alto Unit 42 OutSteel SaintBot February 2022ATTACK:enterprise:G1031 → uses → ATTACK:enterprise:T1059
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8a7baaae-c0d5-4465-917d-4612232a6dae
Palo Alto Unit 42 OutSteel SaintBot February 2022ATTACK:enterprise:G1031 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a2284f0a-630a-45a3-b823-919b3485fda3
Palo Alto Unit 42 OutSteel SaintBot February 2022ATTACK:enterprise:G1031 → uses → ATTACK:enterprise:T1608.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a40c6b38-6a1f-44fa-8f86-c38dcd03fc90
Palo Alto Unit 42 OutSteel SaintBot February 2022ATTACK:enterprise:G1031 → uses → ATTACK:enterprise:S1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cf89fd2c-dc86-4d85-aeaa-b2293803136f
Palo Alto Unit 42 OutSteel SaintBot February 2022ATTACK:enterprise:G1031 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d81d7589-14cb-4f29-b05c-02cb01f183e4
Palo Alto Unit 42 OutSteel SaintBot February 2022ATTACK:enterprise:G1031 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eff4cf6d-b84d-4fd9-9fd5-1b7f5d06fbad
Palo Alto Unit 42 OutSteel SaintBot February 2022