MITRE ATT&CKgroup

G0112 Windshift

Published 2020-06-25 Modified 2026-09-02 Official page ↗
Domain
enterprise, mobile
Aliases
Bahamut
Version
1.1
Created
2020-06-25

Description

Windshift is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government departments and critical infrastructure across the Middle East.

Related

Uses · MITRE ATT&CK (37)

  • T1628.003 Conceal Multimedia Files sub-technique
  • T1417.001 Keylogging sub-technique
  • T1521.001 Symmetric Cryptography sub-technique
  • T1636.003 Contact List sub-technique
  • T1636.004 SMS Messages sub-technique
  • T1627.001 Geofencing sub-technique
  • T1632.001 Code Signing Policy Modification sub-technique
  • T1633.001 System Checks sub-technique
  • S0466 WindTail software (malware)
  • T1071.001 Web Protocols sub-technique
  • T1204.001 Malicious Link sub-technique
  • T1204.002 Malicious File sub-technique
  • T1059.005 Visual Basic sub-technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1566.002 Spearphishing Link sub-technique
  • T1566.003 Spearphishing via Service sub-technique
  • T1518.001 Security Software Discovery sub-technique
  • T1036.001 Invalid Code Signature sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1533 Data from Local System technique
  • T1518 Software Discovery technique
  • T1512 Video Capture technique
  • T1476 Deliver Malicious Application via Other Means technique
  • T1189 Drive-by Compromise technique
  • T1406 Obfuscated Files or Information technique
  • T1407 Download New Code at Runtime technique
  • T1420 File and Directory Discovery technique
  • T1426 System Information Discovery technique
  • T1429 Audio Capture technique
  • T1430 Location Tracking technique
Show all 37 ›

References