Cервис управления информационной безопасностью
Cервис управления информационной безопасностью
Поиск
Вход Регистрация
MITRE ATT&CK - Преступная группа UNC2452
Риски
Каталоги
MITRE ATT&CK
Преступная группа
UNC2452
Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.
Подробнее
Наш канал

UNC2452

UNC2452 is a suspected Russian state-sponsored threat group responsible for the 2020 SolarWinds software supply chain intrusion.(Citation: FireEye SUNBURST Backdoor December 2020) Victims of this campaign include government, consulting, technology, telecom, and other organizations in North America, Europe, Asia, and the Middle East.(Citation: FireEye SUNBURST Backdoor December 2020) The group also compromised at least one think tank by late 2019.(Citation: Volexity SolarWinds)
ID: G0118
Associated Groups: StellarParticle, Dark Halo, NOBELIUM
Version: 1.1
Created: 05 Jan 2021
Last Modified: 25 Apr 2025

Associated Group Descriptions
Name Description
StellarParticle (Citation: CrowdStrike SUNSPOT Implant January 2021)
Dark Halo (Citation: Volexity SolarWinds)
NOBELIUM (Citation: MSTIC NOBELIUM Mar 2021)

Techniques Used
Domain ID Name Use
Enterprise T1098 .001 Account Manipulation: Additional Cloud Credentials

UNC2452 added credentials to OAuth Applications and Service Principals.(Citation: Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks)

.002 Account Manipulation: Additional Email Delegate Permissions

UNC2452 added their own devices as allowed IDs for active sync using Set-CASMailbox, allowing it to obtain copies of victim mailboxes. It also added additional permissions (such as Mail.Read and Mail.ReadWrite) to compromised Application or Service Principals.(Citation: Volexity SolarWinds)(Citation: Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks)

Enterprise T1583 .001 Acquire Infrastructure: Domains

UNC2452 has acquired C2 domains through resellers.(Citation: MSTIC NOBELIUM Mar 2021)(Citation: FireEye SUNSHUTTLE Mar 2021)
Enterprise T1071 .001 Application Layer Protocol: Web Protocols

UNC2452 used HTTP for C2 and data exfiltration.(Citation: Volexity SolarWinds)
Enterprise T1560 .001 Archive Collected Data: Archive via Utility

UNC2452 used 7-Zip to compress stolen emails into password-protected archives prior to exfiltration.(Citation: Volexity SolarWinds)(Citation: Microsoft Deep Dive Solorigate January 2021)
Enterprise T1059 .001 Command and Scripting Interpreter: PowerShell

UNC2452 used PowerShell to create new tasks on remote machines, identify configuration settings, exfiltrate data, and to execute other commands.(Citation: Volexity SolarWinds)(Citation: Microsoft Analyzing Solorigate Dec 2020)
.003 Command and Scripting Interpreter: Windows Command Shell

UNC2452 used cmd.exe to execute commands on remote machines.(Citation: Volexity SolarWinds)(Citation: Microsoft Analyzing Solorigate Dec 2020)

Enterprise T1584 .001 Compromise Infrastructure: Domains

UNC2452 has compromised domains to use for C2.(Citation: MSTIC NOBELIUM Mar 2021)
Enterprise T1074 .002 Data Staged: Remote Data Staging

UNC2452 staged data and files in password-protected archives on a victim's OWA server.(Citation: Volexity SolarWinds)
Enterprise T1587 .001 Develop Capabilities: Malware

UNC2452 developed SUNSPOT, SUNBURST, TEARDROP, and Raindrop; SUNSPOT and SUNBURST were tailored to be incorporated into SolarWind's Orion software library.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: CrowdStrike SUNSPOT Implant January 2021)(Citation: Microsoft Deep Dive Solorigate January 2021)
Enterprise T1484 .002 Domain or Tenant Policy Modification: Trust Modification

UNC2452 changed domain federation trust settings using Azure AD administrative permissions to configure the domain to accept authorization tokens signed by their own SAML signing certificate.(Citation: Microsoft 365 Defender Solorigate)
Enterprise T1114 .002 Email Collection: Remote Email Collection

UNC2452 collected emails from specific individuals, such as executives and IT staff, using New-MailboxExportRequest followed by Get-MailboxExportRequest.(Citation: Volexity SolarWinds)
Enterprise T1546 .003 Event Triggered Execution: Windows Management Instrumentation Event Subscription

UNC2452 used WMI event subscriptions for persistence.(Citation: Microsoft 365 Defender Solorigate)(Citation: Microsoft Deep Dive Solorigate January 2021)
Enterprise T1048 .002 Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

UNC2452 exfiltrated collected data over a simple HTTPS request to a password-protected archive staged on a victim's OWA servers.(Citation: Volexity SolarWinds)
Enterprise T1606 .001 Forge Web Credentials: Web Cookies

UNC2452 bypassed MFA set on OWA accounts by generating a cookie value from a previously stolen secret key.(Citation: Volexity SolarWinds)
.002 Forge Web Credentials: SAML Tokens

UNC2452 created tokens using compromised SAML signing certificates.(Citation: Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks)

Enterprise T1562 .001 Impair Defenses: Disable or Modify Tools

UNC2452 used the service control manager on a remote system to disable services associated with security monitoring products.(Citation: Microsoft Deep Dive Solorigate January 2021)
.002 Impair Defenses: Disable Windows Event Logging

UNC2452 used AUDITPOL to prevent the collection of audit logs.(Citation: Microsoft Deep Dive Solorigate January 2021)

.004 Impair Defenses: Disable or Modify System Firewall

UNC2452 used netsh to configure firewall rules that limited certain UDP outbound packets.(Citation: Microsoft Deep Dive Solorigate January 2021)

Enterprise T1070 .004 Indicator Removal: File Deletion

UNC2452 routinely removed their tools, including custom backdoors, once remote access was achieved.(Citation: FireEye SUNBURST Backdoor December 2020)
.006 Indicator Removal: Timestomp

UNC2452 modified timestamps of backdoors to match legitimate Windows files.(Citation: Microsoft Deep Dive Solorigate January 2021)

Enterprise T1036 .004 Masquerading: Masquerade Task or Service

UNC2452 named tasks \Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager in order to appear legitimate.(Citation: Volexity SolarWinds)
.005 Masquerading: Match Legitimate Resource Name or Location

UNC2452 renamed a version of AdFind to sqlceip.exe or csrss.exe in an attempt to appear as the SQL Server Telemetry Client or Client Service Runtime Process, respectively.(Citation: Volexity SolarWinds)(Citation: Microsoft Analyzing Solorigate Dec 2020)

Enterprise T1003 .006 OS Credential Dumping: DCSync

UNC2452 leveraged privileged accounts to replicate directory service data with domain controllers.(Citation: Microsoft 365 Defender Solorigate)(Citation: Microsoft Deep Dive Solorigate January 2021)
Enterprise T1090 .001 Proxy: Internal Proxy

UNC2452 configured at least one instance of Cobalt Strike to use a network pipe over SMB during the 2020 SolarWinds intrusion.(Citation: Symantec RAINDROP January 2021)
Enterprise T1021 .006 Remote Services: Windows Remote Management

UNC2452 has used WinRM via PowerShell to execute command and payloads on remote hosts.(Citation: Symantec RAINDROP January 2021)
Enterprise T1053 .005 Scheduled Task/Job: Scheduled Task

UNC2452 used scheduler and schtasks to create new tasks on remote hosts as part of lateral movement.(Citation: Volexity SolarWinds) They also manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.(Citation: FireEye SUNBURST Backdoor December 2020) UNC2452 also created a scheduled task to maintain SUNSPOT persistence when the host booted.(Citation: CrowdStrike SUNSPOT Implant January 2021)

Enterprise T1558 .003 Steal or Forge Kerberos Tickets: Kerberoasting

UNC2452 obtained Ticket Granting Service (TGS) tickets for Active Directory Service Principle Names to crack offline.(Citation: Microsoft Deep Dive Solorigate January 2021)
Enterprise T1553 .002 Subvert Trust Controls: Code Signing

UNC2452 was able to get SUNBURST signed by SolarWinds code signing certificates by injecting the malware into the SolarWinds Orion software lifecycle.(Citation: FireEye SUNBURST Backdoor December 2020)
Enterprise T1195 .002 Supply Chain Compromise: Compromise Software Supply Chain

UNC2452 gained initial network access via a trojanized update of SolarWinds Orion software.(Citation: FireEye SUNBURST Backdoor December 2020)
Enterprise T1218 .011 System Binary Proxy Execution: Rundll32

UNC2452 used Rundll32 to execute payloads.(Citation: Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks)(Citation: Microsoft Deep Dive Solorigate January 2021)
Enterprise T1016 .001 System Network Configuration Discovery: Internet Connection Discovery

UNC2452 has used GoldFinder to perform HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request travels through.(Citation: MSTIC NOBELIUM Mar 2021)
Enterprise T1552 .004 Unsecured Credentials: Private Keys

UNC2452 obtained the private encryption key from an Active Directory Federation Services (AD FS) container to decrypt corresponding SAML signing certificates.(Citation: Microsoft 365 Defender Solorigate)
Enterprise T1550 .004 Use Alternate Authentication Material: Web Session Cookie

UNC2452 used a forged duo-sid cookie to bypass MFA set on an email account.(Citation: Volexity SolarWinds)

Software
ID Name References Techniques
S0560 TEARDROP (Citation: FireEye SUNBURST Backdoor December 2020) (Citation: Microsoft Deep Dive Solorigate January 2021) Match Legitimate Resource Name or Location, Windows Service, Deobfuscate/Decode Files or Information, Modify Registry, Obfuscated Files or Information, Query Registry
S0565 Raindrop (Citation: Microsoft Deep Dive Solorigate January 2021) (Citation: Symantec RAINDROP January 2021) Encrypted/Encoded File, Match Legitimate Resource Name or Location, Deobfuscate/Decode Files or Information, Masquerading, Time Based Evasion, Steganography, Software Packing
S0588 GoldMax (Citation: CrowdStrike StellarParticle January 2022) (Citation: FireEye SUNSHUTTLE Mar 2021) (Citation: MSTIC NOBELIUM Mar 2021) (Citation: SUNSHUTTLE) Scheduled Task, Encrypted/Encoded File, Match Legitimate Resource Name or Location, System Checks, Cron, Deobfuscate/Decode Files or Information, Ignore Process Interrupts, Time Based Evasion, System Network Configuration Discovery, Masquerade Task or Service, Exfiltration Over C2 Channel, Asymmetric Cryptography, Windows Command Shell, Software Packing, Web Protocols, Ingress Tool Transfer, System Time Discovery, Junk Data
S0589 Sibot (Citation: MSTIC NOBELIUM Mar 2021) Scheduled Task, Windows Management Instrumentation, Fileless Storage, Rundll32, Match Legitimate Resource Name or Location, Deobfuscate/Decode Files or Information, Modify Registry, System Network Configuration Discovery, Indicator Removal, System Network Connections Discovery, Web Service, Mshta, Query Registry, Command Obfuscation, File Deletion, Web Protocols, Visual Basic, Ingress Tool Transfer
S0154 Cobalt Strike (Citation: FireEye SUNBURST Backdoor December 2020) (Citation: cobaltstrike manual) Windows Management Instrumentation, Screen Capture, Rundll32, Standard Encoding, Keylogging, JavaScript, Bypass User Account Control, Sudo and Sudo Caching, Security Account Manager, DNS, Domain Account, Symmetric Cryptography, Windows Service, Domain Groups, SSH, System Service Discovery, Code Signing, Network Share Discovery, Application Layer Protocol, Native API, Data from Local System, Deobfuscate/Decode Files or Information, Process Injection, Timestomp, Reflective Code Loading, Scheduled Transfer, SMB/Windows Admin Shares, Protocol Tunneling, Browser Session Hijacking, Modify Registry, Windows Remote Management, LSASS Memory, Distributed Component Object Model, System Network Configuration Discovery, Office Template Macros, File and Directory Discovery, System Network Connections Discovery, Token Impersonation/Theft, Make and Impersonate Token, Process Discovery, Parent PID Spoofing, PowerShell, Multiband Communication, File Transfer Protocols, Local Groups, Disable or Modify Tools, Indicator Removal from Tools, Process Hollowing, Exploitation for Privilege Escalation, Obfuscated Files or Information, Exploitation for Client Execution, Asymmetric Cryptography, Non-Application Layer Protocol, Protocol or Service Impersonation, Query Registry, Data Transfer Size Limits, Domain Accounts, BITS Jobs, Domain Fronting, Python, Windows Command Shell, Web Protocols, Visual Basic, Remote System Discovery, Network Service Discovery, Software Discovery, Pass the Hash, Ingress Tool Transfer, Remote Desktop Protocol, Service Execution, Dynamic-link Library Injection, Internal Proxy, Custom Command and Control Protocol, Commonly Used Port, Local Accounts, Process Argument Spoofing
S0559 SUNBURST (Citation: FireEye SUNBURST Backdoor December 2020) (Citation: Microsoft Deep Dive Solorigate January 2021) (Citation: SolarWinds Sunburst Sunspot Update January 2021) (Citation: Solorigate) Windows Management Instrumentation, System Owner/User Discovery, Rundll32, Standard Encoding, DNS, Match Legitimate Resource Name or Location, Symmetric Cryptography, System Checks, System Service Discovery, Code Signing, System Information Discovery, Clear Network Connection History and Configurations, Data from Local System, Time Based Evasion, Modify Registry, Image File Execution Options Injection, System Network Configuration Discovery, Indicator Removal, File and Directory Discovery, Dynamic Resolution, Process Discovery, Disable or Modify Tools, Indicator Removal from Tools, Obfuscated Files or Information, Protocol or Service Impersonation, Query Registry, Security Software Discovery, Clear Persistence, File Deletion, Web Protocols, Visual Basic, Ingress Tool Transfer, Steganography, System Time Discovery, Junk Data, Compression
S0002 Mimikatz (Citation: Adsecurity Mimikatz Guide) (Citation: Deply Mimikatz) (Citation: Microsoft 365 Defender Solorigate) Security Account Manager, LSA Secrets, Credentials from Password Stores, Security Support Provider, Rogue Domain Controller, Credentials from Web Browsers, Private Keys, LSASS Memory, Golden Ticket, Pass the Ticket, Steal or Forge Authentication Certificates, Account Manipulation, SID-History Injection, Silver Ticket, Windows Credential Manager, Pass the Hash, DCSync
S0562 SUNSPOT (Citation: CrowdStrike SUNSPOT Implant January 2021) Match Legitimate Resource Name or Location, Stored Data Manipulation, Native API, Deobfuscate/Decode Files or Information, Mutual Exclusion, File and Directory Discovery, Execution Guardrails, Process Discovery, Obfuscated Files or Information, Compromise Software Supply Chain, File Deletion, Access Token Manipulation
S0552 AdFind (Citation: FireEye FIN6 Apr 2019) (Citation: FireEye Ryuk and Trickbot January 2019) (Citation: Microsoft Analyzing Solorigate Dec 2020) (Citation: Red Canary Hospital Thwarted Ryuk October 2020) Domain Account, Domain Groups, System Network Configuration Discovery, Domain Trust Discovery, Remote System Discovery

References

  1. Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.
  2. MSRC. (2020, December 13). Customer Guidance on Recent Nation-State Cyber Attacks. Retrieved December 30, 2020.
  3. CrowdStrike Intelligence Team. (2021, January 11). SUNSPOT: An Implant in the Build Process. Retrieved January 11, 2021.
  4. FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.
  5. Smith, L., Leathery, J., Read, B. (2021, March 4). New SUNSHUTTLE Second-Stage Backdoor Uncovered Targeting U.S.-Based Entity; Possible Connection to UNC2452. Retrieved March 12, 2021.
  6. Microsoft 365 Defender Team. (2020, December 28). Using Microsoft 365 Defender to protect against Solorigate. Retrieved January 7, 2021.
  7. MSTIC. (2020, December 18). Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers . Retrieved January 5, 2021.
  8. MSTIC, CDOC, 365 Defender Research Team. (2021, January 20). Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop . Retrieved January 22, 2021.
  9. Symantec Threat Hunter Team. (2021, January 18). Raindrop: New Malware Discovered in SolarWinds Investigation. Retrieved January 19, 2021.
  10. Cash, D. et al. (2020, December 14). Dark Halo Leverages SolarWinds Compromise to Breach Organizations. Retrieved December 29, 2020.
Навигация

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.