Dark Halo

Dark Halo is a state-sponsored espionage threat actor linked to intrusions against a US-based think tank and associated with activity overlapping the SolarWinds supply-chain compromise. The group has been publicly connected in reporting to UNC2452 and, by anonymous government sourcing cited in major media, to APT29/Cozy Bear, a cluster widely believed to be tied to Russia. Dark Halo has been described as highly skilled, persistent, and capable of maintaining long-term access while minimizing forensic visibility. Observed operations show a strong focus on intelligence collection, especially theft of email from selected executives, policy experts, and IT personnel. In one environment, the actor conducted multiple separate intrusions over several years, returned after apparent eviction, and used both malware and living-off-the-land techniques. Reported tradecraft included exploitation of Microsoft Exchange Control Panel for re-entry, abuse of Exchange administrative tooling and PowerShell cmdlets for reconnaissance and post-compromise operations, use of scheduled tasks for lateral movement, mailbox export operations to collect targeted mail, manipulation of ActiveSync settings to authorize attacker-controlled devices, and cleanup actions to remove evidence after collection. Dark Halo also demonstrated the ability to bypass Duo-protected multi-factor authentication in Outlook Web Access after deep compromise of the server-side environment. Rather than exploiting a product vulnerability or hijacking an existing session, the actor obtained the Duo integration secret from the compromised server and used it to generate a valid MFA-related session value, allowing access when combined with valid user credentials. This reflects mature post-exploitation capability, credential abuse, defense evasion, and a detailed understanding of enterprise authentication integrations. Malware associated with the actor includes Sunshuttle. Dark Halo has also been tied to infrastructure and operational overlap with the broader SolarWinds campaign. Overall, the actor is best characterized as a sophisticated Russian-linked espionage operator focused on stealthy access, credentialed abuse of enterprise services, and selective exfiltration of high-value communications.