Automation · API / MCP 中文

Group profile · G0118

UNC2452

UNC2452 is a suspected Russian state-sponsored threat group responsible for the 2020 SolarWinds software supply chain intrusion. Victims of this campaign include government, consulting, technology, telecom, and other organizations in North America, Europe, Asia, and the Middle East. The group also compromised at least one think tank by late 2019.

ATT&CK G0118 Confidence High · 100 Source src_mitre_attck_enterprise Status active

UNC2452 is a suspected Russian state-sponsored threat group responsible for the 2020 SolarWinds software supply chain intrusion.1 Victims of this campaign include government, consulting, technology, telecom, and other organizations in North America, Europe, Asia, and the Middle East.2 The group also compromised at least one think tank by late 2019.3

  1. FireEye SUNBURST Backdoor December 2020
  2. FireEye SUNBURST Backdoor December 2020
  3. Volexity SolarWinds

Claims and citations

Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.

predicateobjectValidConf.Evidence
also_known_asUNC2452— → …100src_mitre_attck_enterprise
also_known_asNOBELIUM— → …100src_mitre_attck_enterprise
also_known_asStellarParticle— → …100src_mitre_attck_enterprise
also_known_asDark Halo— → …100src_mitre_attck_enterprise

Technique use

No technique use yet; ATT&CK sync fills it by citation year.

Aliases

Dark Halo · NOBELIUM · StellarParticle · UNC2452

Reading and review

Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.

Corrections