UNC2452

MITRE ATT&CK: G0118 View on attack.mitre.org

Aliases: NOBELIUM, StellarParticle, Dark Halo, DarkHalo, Solar Phoenix, Midnight Blizzard, UNC2452

Origin
RU
Profile updated
2026-07-07 11:28:43

Context

UNC2452 is a suspected Russian state-sponsored threat group responsible for the 2020 SolarWinds software supply chain intrusion. Victims of this campaign include government, consulting, technology, telecom, and other organizations in North America, Europe, Asia, and the Middle East. The group also compromised at least one think tank by late 2019.

Related threat objects

Reports & references

  • medium.com — Identifying Unc2452 Related Techniques 9F7B6C7F3714 (report)
  • Mandiant — Evasive Attacker Leverages Solarwinds Supply Chain Compromises With Sunburst Backdoor (report)
  • news.sophos.com — How Sunburst Malware Does Defense Evasion (report)
  • Microsoft — Analyzing Solorigate The Compromised Dll File That Started A Sophisticated Cyberattack And How Microsoft Defender Helps Protect (report)
  • pastebin.com — 6Edgckxd (report)
  • github.com — Sunburst Countermeasures (report)
  • Microsoft — Goldmax Goldfinder Sibot Analyzing Nobelium Malware (report)
  • Mandiant — Sunshuttle Second Stage Backdoor Targeting Us Based Entity (report)
  • Palo Alto Unit 42 — Solarphoenix (report)
  • Microsoft — Midnight Blizzard Guidance For Responders On Nation State Attack (report)
  • Microsoft — Midnight Blizzard Conducts Targeted Social Engineering Over Microsoft Teams (report)
  • CrowdStrike — Sunspot Malware Technical Analysis (report)
  • volexity.com — Dark Halo Leverages Solarwinds Compromise To Breach Organizations (report)
  • MITRE ATT&CK — G0118 (report)

Attributed from

  • APT29 TeamCity Exploits (campaign)
  • HPE Midnight Blizzard Office 365 Email Exfiltration (campaign)
  • Microsoft Midnight Blizzard Breach (campaign)
  • Midnight Blizzard RDP File Spearphishing Campaign (campaign)
  • Russian SVR Cyber Operations and Vulnerability Exploitation Activity (campaign)
  • SolarWinds Compromise (campaign)

External references