SaintBear is a threat actor attributed to RU, also known as EMBER BEAR, Lorec Bear, G1003. This group is tracked in the Strobes VI threat intelligence database.

What vulnerabilities does SaintBear exploit?

SaintBear is known to exploit 7 CVEs. View the full list on the Strobes VI threat actor profile page.

Agentic AI · Pentesting

Ready for Agentic Automated Testing?

Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.

Zero false positives

PoC for every finding

30+ tools orchestrated

Book a Demo Learn More

Setup in 5 minutesSOC 2 & ISO 27001

SaintBear

Also known as: EMBER BEAR, Lorec Bear, G1003, UAC-0056, Frozenvista, DEV-0586, FROZENVISTA, Cadet Blizzard, TA471, Nascent Ursa, Bleeding Bear, Saint Bear, GRU 161st Specialist Training Center, DEV-0587, Storm-0587, Ember Bear, UNC2589, Lorec53, SaintBear, Nodaria, GRU Unit 29155

RUInformation theft and espionage

Exploited CVEs

Overview

A group targeting UA state organizations using the GraphSteel and GrimPlant malware.

Exploited Vulnerabilities

CVE ID	Action
CVE-2014-7169	View Details