Loading threat actor…
SaintBear is a Russia-linked threat actor name that appears in reporting on the cyber dimensions of the Russia-Ukraine conflict. In the available evidence, the name is mentioned alongside established Russian state-aligned espionage actors such as APT28, Ghostwriter, Sandworm, and Turla, indicating association with the broader Russian threat landscape. However, the supplied facts do not provide a distinct operational profile, confirmed aliases beyond the same spelling variant, malware families uniquely attributable to SaintBear, or a clearly delineated victimology separate from other Russian actors. Based on the directly supported information, SaintBear should be treated as a Russia-linked threat actor designation with insufficient publicly corroborated detail here to confidently characterize its specific tactics, techniques, sub-groups, or campaign history.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
Attributed origin per open-source reporting.
14 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
9 malware families attributed to this actor across reporting.
4 additional families tracked in Mallory.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
238 indicators attributed to this actor. Values are masked here and available in full in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.