Loading threat actor…
UNC1945, commonly associated with the name LightBasin and also rendered Light_Basin, is a threat activity cluster distinguished by advanced expertise in Linux, Unix, and Oracle Solaris environments. Its documented targets include managed service providers and organizations in the financial and professional consulting industries. Compromise of managed service providers has also enabled access to their clients. UNC1945 has used an exploit targeting a stack-based buffer overflow in the Solaris Pluggable Authentication Modules library through SSH keyboard-interactive authentication. Its tooling includes the SLAPSTICK authentication backdoor, TINYSHELL remote-access backdoor, STEELCORGI payload packer, and Mimikatz credential-dumping utility. Its operations emphasize persistent access, credential compromise, lateral movement, and concealment within mission-critical systems. LightBasin has historically been associated with telecommunications intrusions, but some telecom activity previously assigned that name was subsequently attributed to Liminal Panda. UNC2891 shares tools and techniques with UNC1945, but the clusters have not been conclusively established as a single actor. UNC2891’s CAKETAP-enabled ATM fraud and physical-device intrusions should therefore not be treated as established UNC1945 operations.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
17 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
12 malware families Mallory has associated with this actor across public reporting.
7 additional families tracked in Mallory.
2 indicators attributed to this actor. Values are masked here and available in full in Mallory.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.