Security Firms Attacked

In this post, we document the list of Security firms attacked by UNC2452. While many of these firms were breached, some were not.

In the notes below, we consider a firm to be breached via SUNBURST if UNC2452 proceeded to a second-stage C2 using the original SUNBURST malware embedded inside Orion ¹. A firm is deemed to be breached by means other than SUNBURST if UNC2452 established a presence inside the its IT infrastructure or exfiltrated data (by means other than SUNBURST).

FireEye

Attack disclosed: Dec 8, 2020 ²
Earliest known attack date:
Breached: Yes
SUNBURST used: Yes ³

Mimecast

Attack disclosed: Jan 12, 2021 ⁴ ⁵
Earliest known attack date:
Breached: Yes
SUNBURST used: Yes ⁶

Palo Alto Networks

Attack disclosed: Jan 25, 2021 ⁷, ⁸
Earliest known attack date: Sep 29, 2020 ⁹
Breached: Yes
SUNBURST used: Yes

Qualys

Attack disclosed: Jan 25, 2021 ⁷, ⁸
Earliest known attack date: July 7, 2020 ⁹
Breached: Yes
SUNBURST used: Yes

Fidelis

Attack disclosed: Jan 25, 2021 ⁷, ⁸
Earliest known attack date: May 18, 2020 ⁹
Breached: Yes
SUNBURST used: Yes ¹⁰

Microsoft

Attack disclosed: Dec 17, 2020 ¹¹
Earliest known attack date:
Breached: Yes
SUNBURST used: Yes

Cisco

Attack disclosed: Dec 21, 2020 ¹²
Earliest known attack date: May 16, 2020 ⁹
Breached: Yes
SUNBURST used: Yes ¹³

VMware

Attack disclosed: Dec 21, 2020 ¹²
Earliest known attack date:
Breached: No ¹⁴
SUNBURST used: Yes ¹⁵

MalwareBytes

Attack disclosed: Jan 19, 2021 ¹⁶
Earliest known attack date:
Breached: Yes
SUNBURST used: No ¹⁷

CrowdStrike

Attack disclosed: Dec 23, 2020 ¹⁸, ¹⁹
Earliest known attack date:
Breached: No
SUNBURST used: No