LightBasin
 |
 | This article may be confusing or unclear to readers. In particular, the article does not explain what a LightBasin is to a non-technical reader who is not a computer security specialist in persistent threats. (April 2022) |
It is proposed that this article be deleted because of the following concern:
If you can address this concern by improving, copyediting, sourcing, renaming, or merging the page, please edit this page and do so. You may remove this message if you improve the article or otherwise object to deletion for any reason. Although not required, you are encouraged to explain why you object to the deletion, either in your edit summary or on the talk page. If this template is removed, do not replace it. The article may be deleted if this message remains in place for seven days, i.e., after 18:20, 14 August 2025 (UTC). Find sources: "LightBasin" – news · newspapers · books · scholar · JSTOR Nominator: Please consider notifying the author/project: {{subst:proposed deletion notify|LightBasin|concern=The article published by CrowdStrike on this actor which was used for the vast majority of information was edited in November 2024 to change attribution of the attack to another actor group. This article is now primarily contains incorrect information. Additionally, LightBasin has had no notable activity in the last several years, which would warrant an article.}} ~~~~ |
LightBasin, also called UNC1945 by Mandiant, is a suspected Chinese cyber espionage group that has been described as an advanced persistent threat that has been linked to multiple cyberattacks on telecommunications companies.[1][2][3] As an advanced persistent threat, they seek to gain unauthorized access to a computer network and remain undetected for an extended period. They have been linked to attacks targeting Linux and Solaris systems.[1][2][3]
History
[edit]The LightBasin cyber espionage group has operated since 2016.[1][2] CrowdStrike say that they are based in China, though their exact location isn't known.[1] They have targeted 13 telecoms operators.[2]
Targets
[edit]CrowdStrike says that the group is unusual in targeting protocols and technology of telecoms operators.[1] According to CrowdStrike's investigation of one such breach, LightBasin leveraged external Domain Name System (eDNS) servers — which are part of the General Packet Radio Service (GPRS) network and play a role in roaming between different mobile operators — to connect directly to and from other compromised telecommunication companies’ GPRS networks via Secure Shell and through previously established implants. Many of their tools are written for them rather than being off the shelf.[1]
After compromising a system, they then installed a backdoor, known as SLAPSTICK, for the Solaris Pluggable authentication module.[2] They utilize TinyShell, which is a Python command shell used to control and execute commands through HTTP requests to a web shell,[4] to communicate with attackers' ip addresses. The scripts are tunneled through an SGSN emulator, which CrowdStrike says is to maintain OPSEC.[3] Serving GPRS Support Node (SGSN) is a main component of the GPRS network, which handles all packet switched data within the network, e.g. the mobility management and authentication of the users.[5] Utilizing this form of tunneling makes it less likely to be restricted or inspected by network security solutions.[1][3]
CrowdStrike recommends that firewalls dealing with GPRS traffic be configured to limit access to DNS or GPRS tunneling protocol traffic.[1]
References
[edit]- ^ a b c d e f g h Nichols, Shaun (2021-10-20). "'LightBasin' hackers spent 5 years hiding on telco networks". TechTarget. Archived from the original on 2023-11-29. Retrieved 2022-04-08.
- ^ a b c d e Ilascu, Ionut (2021-10-19). "LightBasin hacking group breaches 13 global telecoms in two years". Bleeping Computer. Archived from the original on 2023-07-24. Retrieved 2022-04-08.
- ^ a b c d "LightBasin: A Roaming Threat to Telecommunications Companies". CrowdStrike. 19 October 2021. Archived from the original on 8 April 2022. Retrieved 9 April 2022.
- ^ "Day 27: Tiny SHell (SSH-like backdoor with full-pty terminal)". Medium. 26 January 2019.
- ^ "SGSN". Telecom ABC. Archived from the original on 2022-05-17. Retrieved 2022-05-11.