LightBasin

Also known as: CL-CRI-0025, DecisiveArchitect, LightBasin, Luminal Panda, TH-239, UNC1945

UNC1945 is an APT group that has been targeting telecommunications companies globally. They use Linux-based implants to maintain long-term access in compromised networks. UNC1945 has demonstrated advanced technical abilities, utilizing various tools and techniques to evade detection and move laterally through networks. They have also been observed targeting other industries, such as financial and professional consulting, and have been linked to other threat actors, including MustangPanada and RedDelta.

🌍 Country ["China"]

Introduction

UNC1945 is an APT group that has been targeting telecommunications companies globally. They use Linux-based implants to maintain long-term access in compromised networks. UNC1945 has demonstrated advanced technical abilities, utilizing various tools and techniques to evade detection and move laterally through networks. They have also been observed targeting other industries, such as financial and professional consulting, and have been linked to other threat actors, including MustangPanada and RedDelta.

Activities and Tactics

Country of Origin: 🇨🇳 [“China”]

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • Evilsun:
  • Slapstick:
  • Lemonstick:
  • Logbleach:
  • Oksolo:
  • Openshackle:
  • Pupyrat:
  • Steelcorgi:
  • Tinyshell:
  • QEMU:
  • PingPong:
  • CordScan:
  • FRP:
  • Impacket:
  • Living off the Land:
  • ProxyChains:
  • SIGTRANslator:
  • SMBExec:

Attribution and Evidence

Country of Origin: [“China”] Additional attribution information pending cataloguing.

References

References pending cataloguing.