SaintBear is a threat actor attributed to RU, also known as UNC2589, TA471, UAC-0056. This group is tracked in the Strobes VI threat intelligence database.

What vulnerabilities does SaintBear exploit?

SaintBear is known to exploit 7 CVEs. View the full list on the Strobes VI threat actor profile page.

Agentic AI · Pentesting

Ready for Agentic Automated Testing?

Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.

Zero false positives

PoC for every finding

30+ tools orchestrated

Book a Demo Learn More

Setup in 5 minutesSOC 2 & ISO 27001

SaintBear

Also known as: UNC2589, TA471, UAC-0056, Nascent Ursa, Nodaria, FROZENVISTA, Storm-0587, DEV-0587, Saint Bear, Lorec53, EMBER BEAR, Lorec Bear, Bleeding Bear, Cadet Blizzard, DEV-0586, Frozenvista, GRU Unit 29155, GRU 161st Specialist Training Center

RUCyber Espionage

Exploited CVEs

Overview

A group targeting UA state organizations using the GraphSteel and GrimPlant malware.

Exploited Vulnerabilities

CVE ID	Action
CVE-2016-6662	View Details