Different security companies refer to (presumably) the same attacker using their own naming scheme. In this post, we list the names used by security companies for the SolarWinds hack perpetrators, along with name equivalences where applicable.

APT28

  • The APT28 designation is used by FireEye 1
  • Unit 26165, GRU 2
  • Also known as Fancy Bear: CrowdStrike 3

APT29

  • The APT29 designation is used by FireEye
  • Also known as Cozy Bear: CrowdStrike 4

Sandworm

  • Unit 74455, GRU 2
    • FireEye appears to club Unit 74455 with Unit 26165
  • Also known as Voodoo Bear: CrowdStrike 5

UNC2452

  • The UNC designation is used by FireEye for as yet un-categorized (unknown) attackers 6
  • Dark Halo: Volexity 7
  • SolarStorm: Palo Alto Networks 8
  • Stellar Particle: CrowdStrike 9,10
  • NOBELIUM: Microsoft 11
  • As per an White House statement 12, the SolarWinds hack was perpetrated by APT29. In other words UNC2452 is the same as APT29

Turla Group

  • As per 13, this group may be the same as UNC2452
    • Snake, Krypton 14
    • Venomous Bear: CrowdStrike 15

References

  1. https://www.fireeye.com/current-threats/apt-groups.html ↩

  2. Sandworm, Andy Greenberg, 2019 ↩ ↩2

  3. https://www.crowdstrike.com/blog/who-is-fancy-bear/ ↩

  4. https://www.crowdstrike.com/blog/who-is-cozy-bear/ ↩

  5. https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-january-voodoo-bear/ ↩

  6. https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html ↩

  7. https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/ ↩

  8. https://unit42.paloaltonetworks.com/fireeye-solarstorm-sunburst/ ↩

  9. https://www.youtube.com/watch?v=4X7CDAOPtIs&t=278s ↩

  10. https://www.youtube.com/watch?v=IPozXgMqMag ↩

  11. https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/ ↩

  12. https://www.whitehouse.gov/briefing-room/statements-releases/2021/04/15/fact-sheet-imposing-costs-for-harmful-foreign-activities-by-the-russian-government/ ↩

  13. https://securelist.com/sunburst-backdoor-kazuar/99981/ ↩

  14. https://en.wikipedia.org/wiki/Turla_(malware) ↩

  15. https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-march-venomous-bear/ ↩