A Roaming Threat to Telecommunications Companies | CrowdStrike
Tags
country: China
attack-pattern: Data Credentials - T1589.001 Dns - T1071.004 Dns - T1590.002 Ip Addresses - T1590.005 Malware - T1587.001 Malware - T1588.001 Server - T1583.004 Server - T1584.004 Software - T1592.002 Ssh - T1021.004 Virtual Private Server - T1583.003 Virtual Private Server - T1584.003 Tool - T1588.002 Connection Proxy - T1090
Show in Graph
Common Information
Type Value
UUID a9cb6b39-6821-46b1-918f-9e8b08ea7f05
Fingerprint b4813bdd8073ae8d
Analysis status DONE
Considered CTI value 2
Text language
Published Oct. 19, 2021, 7 a.m.
Added to db Sept. 11, 2022, 12:42 p.m.
Last updated Nov. 17, 2024, 5:50 p.m.
Headline LightBasin: A Roaming Threat to Telecommunications Companies
Title A Roaming Threat to Telecommunications Companies | CrowdStrike
Detected Hints/Tags/Attributes 92/2/22
Source URLs
Redirection Url
Details Source https://www.crowdstrike.com/blog/an-analysis-of-lightbasin-telecommunications-attacks/
URL Provider
Details Provider Source level domain
Details crowdstrike.com www.crowdstrike.com
Attributes
Details Type #Events CTI Value
Details Domain 5 
osmocom.org
Details File 7 
frpc.ini
Details sha256 1 
97d4c9b5750d614face73d11ba8532e53594332af53f4c07c1543195225b76eb
Details sha256 1 
e9c0f00c34dcd28fc3cc53c9496bff863b81b06723145e106ab7016c66581f72
Details sha256 1 
3a259ad7e5c19a782f7736b5ac50aac4ba4d03b921ffc6a3ff6a48d720f02012
Details sha256 1 
05537c1c4e29db76a24320fb7cb80b189860389cdb16a9dbeb0c8d30d9b37006
Details sha256 1 
6d3759b3621f3e4791ebcd28e6ea60ce7e64468df24cf6fddf8efb544ab5aec0
Details sha256 1 
cdf230a7e05c725a98ce95ad8f3e2155082d5a6b1e839c2b2653c3754f06c2e7
Details sha256 1 
917495c2fd919d4d4baa2f8a3791bcfd58d605ee457a81feb52bc65eb706fd62
Details sha256 1 
bf5806cebc5d1a042f87abadf686fb623613ed33591df1a944b5e7879fb189c8
Details sha256 1 
a388e2ac588be6ab73d7e7bbb61d83a5e3a1f80bf6a326f42b6b5095a2f35df3
Details IPv4 1 
45.76.215.0
Details IPv4 1 
167.179.91.0
Details IPv4 1 
45.32.116.0
Details IPv4 1 
207.148.24.0
Details IPv4 1 
172.104.79.0
Details IPv4 1 
45.33.77.0
Details IPv4 1 
139.162.156.0
Details IPv4 1 
172.104.236.0
Details IPv4 1 
172.104.129.0
Details Mandiant Uncategorized Groups 18 
UNC1945
Details Url 1 
https://osmocom.org/projects/openggsn/wiki/sgsnemu