Lorec53

Threat Actor updated 4 months ago (2024-05-04T17:10:27.840Z)
Download STIX
Preview STIX
Lorec53, also known as UAC-0056, TA471, SaintBear, and Ember Bear, is a threat actor group associated with numerous cyberattacks, particularly against Ukraine and Georgia. This group has been identified by various cybersecurity organizations, each using a different moniker to track its activities. The cybersecurity industry's lack of standard naming conventions has led to this multiplicity of names for the same threat actor. The group's actions have been linked to malicious intent, with the potential involvement of individuals, private companies, or even government entities. The Ukrainian Computer Emergency Response Team (CERT-UA) has specifically attributed a significant cyberattack in Ukraine to this group. The attack had various overlaps with previous campaigns targeting other organizations in Ukraine, Georgia, and other nations' assets local to Ukraine. These repeated attacks suggest a pattern of aggressive action against these countries, potentially revealing geopolitical motivations behind the group's activities. Notably, the group's activities have been aligned with those of the Russia-associated Ember Bear group, indicating possible connections or similarities in tactics, techniques, and procedures. Government experts have also attributed the attacks to UAC-0056, associating it with other groups like DEV-0586, unc2589, and Nodaria. As Lorec53 continues to pose a significant threat to cybersecurity, ongoing monitoring and research are crucial to understanding and mitigating its impact.
Description last updated: 2023-10-10T22:48:27.749Z
What's your take? (Question 1 of 0)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Aliases We are not currently tracking any aliases
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Ukraine
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Source Document References
Information about the Lorec53 Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
PreviewSource LinkCreatedAtTitle
MITRE
2 years ago
Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot
CSO Online
2 years ago
US warns of cyberattacks by Russia on anniversary of Ukraine war
Securityaffairs
2 years ago
CERT of Ukraine: Russia-linked APT backdoored multiple govt sites
CERT-EU
2 years ago
L’hebdo cybersécurité | 26 fév 2023 • Cybersécurité