Windshift (G0112) | Threat Actor Index

About Windshift

Windshift is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government departments and critical infrastructure across the Middle East.

View MITRE record ↗

Techniques by Tactic (19)

Initial Access

T1189 Drive-by CompromiseT1566.001 Spearphishing AttachmentT1566.002 Spearphishing LinkT1566.003 Spearphishing via Service

Execution

T1047 Windows Management InstrumentationT1059.005 Visual BasicT1204.001 Malicious LinkT1204.002 Malicious File

Persistence

T1547.001 Registry Run Keys / Startup Folder

Privilege Escalation

T1547.001 Registry Run Keys / Startup Folder

Stealth

T1027 Obfuscated Files or InformationT1036 MasqueradingT1036.001 Invalid Code Signature

Discovery

T1033 System Owner/User DiscoveryT1057 Process DiscoveryT1082 System Information DiscoveryT1518 Software DiscoveryT1518.001 Security Software Discovery

Command & Control

T1071.001 Web ProtocolsT1105 Ingress Tool Transfer

Toolsets (1)

🐛

WindTail S0466

Malware · macOS

References & Reports (3)