H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[OutSteel](https://attack.mitre.org/software/S1017) is a file uploader and document stealer developed with the scripting language AutoIT that has been used by [Saint Bear](https://attack.mitre.org/groups/G1031) since at least March 2021.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )

Labels

malware

18 recorded

Relationships

uses

to AutoHotKey & AutoIT

Technique

uses

to Automated Collection

Technique

uses

to Automated Exfiltration

Technique

uses

to Data from Local System

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Lateral Tool Transfer

Technique

uses

to Malicious File

Technique

uses

to Malicious Link

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Process Discovery

Technique

uses

to Spearphishing Attachment

Technique

uses

to Spearphishing Link

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

uses

from Saint Bear

Group

2 external

References

mitre-attack

S1017

Palo Alto Unit 42 OutSteel SaintBot February 2022

https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/