LightBasin__2021__LightBasin_A-Roaming-Threat-to-Telecommunications-Companies_CrowdStrike.pdf

CrowdStrike details the LightBasin (UNC1945) activity cluster — a sophisticated, long-running actor targeting global telecommunications providers to collect subscriber and call metadata. The report describes intrusion methods (SSH password-spraying, implants on Linux/Solaris), specialized tooling and emulation of telecom protocols (SGSN/GTP tunneling with sgsnemu and TinyShell), additional malware (CordScan, SIGTRANslator), persistence/evasion techniques, and a set of IOCs and mitigation recommendations for telco operators.