LightBasinThreat actor
- cl-cri-0025
- UNC1945
UNC1945 is an APT group that has been targeting telecommunications companies globally. They use Linux-based implants to maintain long-term access in compromised networks. UNC1945 has demonstrated advanced technical abilities, utilizing various tools and techniques to evade detection and move laterally through networks.From MISP Galaxy
Last reported 17 months ago, by Group-IB1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1556Modify Authentication Process
“T1556.003 – Modify Authentication Process: Pluggable Authentication Modules”
- T1556.003Pluggable Authentication Modules
“T1556.003 – Modify Authentication Process: Pluggable Authentication Modules”
What the reports say
1 report, newest first · the exact sentence from each-
Understanding Credential Harvesting via PAM: A Real-World Threat“UNC1945 used a PAM backdoor on Solaris servers to steal credentials and facilitate lateral movement.”
Thanks — we review every report.