LightBasin
Also reported as UNC1945, CL-CRI-0025, TH-239, DecisiveArchitect and Luminal Panda. Linked to China by one source.
Reports per quarter
Techniques seen in the last two years
- T1021.001 1 report
- T1021.004 1 report
- T1027 1 report
- T1046 1 report
- T1059 1 report
- T1059.001 1 report
- T1070.004 1 report
- T1070.006 1 report
- T1071 1 report
- T1082 1 report
Show all 17 techniques Show fewer
Counts come from technique IDs in the actor's report text.
CVEs named in reports
- CVE-2014-0160 KEV
- CVE-2016-0545
- CVE-2019-0604 KEV ransomware
- CVE-2019-0708 KEV ransomware
- CVE-2019-3010 KEV
- CVE-2020-0688 KEV ransomware
- CVE-2020-14750 KEV
- CVE-2020-14871 KEV
- CVE-2020-14882 KEV
KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.
Reports
-
Threat Group Cards: A Threat Actor Encyclopedia
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia
-
New ShroudedSnooper actor targets telecommunications firms in the Middle East with novel Implants
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor New ShroudedSnooper actor targets telecommunications firms in the Middle East with novel Implants
-
Hunting a Global Telecommunications Threat- DecisiveArchitect and Its Custom Implant JustForFun
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Hunting a Global Telecommunications Threat- DecisiveArchitect and Its Custom Implant JustForFun
-
The link to Mirror on Box failed its last check. Mirror on Box Detailsfor An Overview of UNC2891
Show all 27 reports Show fewer
-
New Unix rootkit used to steal ATM banking data
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New Unix rootkit used to steal ATM banking data
-
Have Your Cake and Eat it Too- An Overview of UNC2891
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Have Your Cake and Eat it Too- An Overview of UNC2891
-
LightBasin- A Roaming Threat to Telecommunications Companies
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor LightBasin- A Roaming Threat to Telecommunications Companies
-
LightBasin_A-Roaming-Threat-to-Telecommunications-Companies_CrowdStrike
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor LightBasin_A-Roaming-Threat-to-Telecommunications-Companies_CrowdStrike
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Report2021ThreatHunting
-
Opening “STEELCORGI”- A Sophisticated APT Swiss Army Knife
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Opening “STEELCORGI”- A Sophisticated APT Swiss Army Knife
-
yoroi.company-Opening STEELCORGI A Sophisticated APT Swiss Army Knife
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor yoroi.company-Opening STEELCORGI A Sophisticated APT Swiss Army Knife
-
DebUNCing Attribution How Mandiant Tracks Uncategorized Threat Actors
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor DebUNCing Attribution How Mandiant Tracks Uncategorized Threat Actors
-
yoroi.company-Shadows From the Past Threaten Italian Enterprises
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor yoroi.company-Shadows From the Past Threaten Italian Enterprises
-
Shadows From The Past Threaten Italian Enterprises
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Shadows From The Past Threaten Italian Enterprises
-
Living Off The Land on a Private Island- An Overview of UNC1945
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Living Off The Land on a Private Island- An Overview of UNC1945
-
In Wild Critical Buffer Overflow Vulnerability in Solaris Can Allow Remote Takeover — CVE-2020-14871
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor In Wild Critical Buffer Overflow Vulnerability in Solaris Can Allow Remote Takeover — CVE-2020-14871
-
fireeye.com-Live off the Land How About Bringing Your Own Island An Overview of UNC1945
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor fireeye.com-Live off the Land How About Bringing Your Own Island An Overview of UNC1945
-
Live off the Land- How About Bringing Your Own Island- An Overview of UNC1945
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Live off the Land- How About Bringing Your Own Island- An Overview of UNC1945
Newest first. Details opens the report in Explore.