SaintBear is a threat actor attributed to RU, also known as TA471, Bleeding Bear, UAC-0056. This group is tracked in the Strobes VI threat intelligence database.

What vulnerabilities does SaintBear exploit?

SaintBear is known to exploit 7 CVEs. View the full list on the Strobes VI threat actor profile page.

Agentic AI · Pentesting

Ready for Agentic Automated Testing?

Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.

Zero false positives

PoC for every finding

30+ tools orchestrated

Book a Demo Learn More

Setup in 5 minutesSOC 2 & ISO 27001

SaintBear

Also known as: TA471, Bleeding Bear, UAC-0056, Nascent Ursa, Storm-0587, DEV-0587, Lorec Bear, DEV-0586, Frozenvista, Nodaria, Saint Bear, EMBER BEAR, Cadet Blizzard, UNC2589, Lorec53, FROZENVISTA

Exploited CVEs

Overview

A group targeting UA state organizations using the GraphSteel and GrimPlant malware.

Exploited Vulnerabilities

CVE ID	Action
CVE-2016-6662	View Details