LightBasin
Aliases: UNC1945, CL-CRI-0025
- First seen
- 2016-01-01 00:00:00
- Primary motivation
- espionage
- Sophistication
- advanced
- Resource level
- government
- Actor type
- nation-state
- Profile updated
- 2026-07-07 12:07:07
Targeted industries: technology-and-telecommunications financial-services professional-services
Context
UNC1945 is an APT group that has been targeting telecommunications companies globally. They use Linux-based implants to maintain long-term access in compromised networks. UNC1945 has demonstrated advanced technical abilities, utilizing various tools and techniques to evade detection and move laterally through networks. They have also been observed targeting other industries, such as financial and professional consulting, and have been linked to other threat actors, including MustangPanada and RedDelta.
Reports & references
- Cisco Talos — Introducing Shrouded Snooper (report)
- Mandiant — Unc2891 Overview (report)
- CrowdStrike — An Analysis Of Lightbasin Telecommunications Attacks (report)