自动化接入 · API / MCP EN

组织档案 · G0118

UNC2452

UNC2452 is a suspected Russian state-sponsored threat group responsible for the 2020 SolarWinds software supply chain intrusion. Victims of this campaign include government, consulting, technology, telecom, and other organizations in North America, Europe, Asia, and the Middle East. The group also compromised at least one think tank by late 2019.

ATT&CK G0118 置信带 高 · 100 来源 src_mitre_attck_enterprise 状态 active

UNC2452 is a suspected Russian state-sponsored threat group responsible for the 2020 SolarWinds software supply chain intrusion.1 Victims of this campaign include government, consulting, technology, telecom, and other organizations in North America, Europe, Asia, and the Middle East.2 The group also compromised at least one think tank by late 2019.3

  1. FireEye SUNBURST Backdoor December 2020
  2. FireEye SUNBURST Backdoor December 2020
  3. Volexity SolarWinds

断言与引用

每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。

predicateobject有效期置信证据
also_known_asUNC2452— → …100src_mitre_attck_enterprise
also_known_asNOBELIUM— → …100src_mitre_attck_enterprise
also_known_asStellarParticle— → …100src_mitre_attck_enterprise
also_known_asDark Halo— → …100src_mitre_attck_enterprise

技术使用

尚无技术使用记录；ATT&CK 同步后按引用年份出现。

别名

Dark Halo · NOBELIUM · StellarParticle · UNC2452

读取与复核

记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。

纠错