UNC2891

Also known as: UNC2891

(Mandiant) The Mandiant Advanced Practices team previously published a threat research blog post that provided an overview of UNC1945 (‘LightBasin’) operations where the actor compromised managed services providers to gain access to targets in the financial and professional consulting industries. Since that time, Mandiant has investigated and attributed several intrusions to a threat cluster we believe has a nexus to this actor, currently being tracked as UNC2891. Through these investigations, Mandiant has discovered additional techniques, malware, and utilities being used by UNC2891 alongside those previously observed in use by UNC1945. Despite having identified significant overlaps between these threat clusters, Mandiant has not determined they are attributable to the same actor.

🌍 Country ["[Unknown]"]
📅 Activity 2022 — 2022
2022
2022

Introduction

(Mandiant) The Mandiant Advanced Practices team previously published a threat research blog post that provided an overview of UNC1945 (‘LightBasin’) operations where the actor compromised managed services providers to gain access to targets in the financial and professional consulting industries. Since that time, Mandiant has investigated and attributed several intrusions to a threat cluster we believe has a nexus to this actor, currently being tracked as UNC2891. Through these investigations, Mandiant has discovered additional techniques, malware, and utilities being used by UNC2891 alongside those previously observed in use by UNC1945. Despite having identified significant overlaps between these threat clusters, Mandiant has not determined they are attributable to the same actor.

Activities and Tactics

Country of Origin: 🏳️ [“[Unknown]”]

First Seen: 2022

Last Activity: 2022

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No atomic indicators are listed in this profile. The APTnotes snapshot indexes 1 public reports that may contain IOCs; see Source Attribution for dataset links.

Malware and Tools

  • BINBASH
  • CAKETAP
  • MIGLOGCLEANER
  • SLAPSTICK
  • STEELCORGI
  • STEELHOUND
  • SUN4ME
  • Tiny SHell
  • WINGCRACK
  • WINGHOOK
  • WIPERIGHT
  • BINBASH:
  • CAKETAP:
  • MIGLOGCLEANER:
  • SLAPSTICK:
  • STEELCORGI:
  • STEELHOUND:
  • SUN4ME:
  • Tiny SHell:
  • WINGCRACK:
  • WINGHOOK:
  • WIPERIGHT:

Attribution and Evidence

Country of Origin: [“[Unknown]”] Additional attribution information pending cataloguing.

References

References pending cataloguing.