Windshift
Also reported as Bahamut, WindShift and Windy Phoenix.
Reports per quarter
Techniques seen in the last two years
- T1430 3 reports in ATT&CK
- T1418 2 reports reports only
- T1426 2 reports in ATT&CK
- T1429 2 reports in ATT&CK
- T1636.002 2 reports reports only
- T1636.004 2 reports in ATT&CK
- T0869 1 report reports only
- T1398 1 report reports only
- T1406 1 report in ATT&CK
- T1417.001 1 report in ATT&CK
Show all 21 techniques Show fewer
Counts come from technique IDs in the actor's report text. “Reports only” means reports name the technique but MITRE ATT&CK® does not list it for this actor.
Also listed by ATT&CK
CVEs named in reports
- CVE-2011-1255
- CVE-2012-0158 KEV ransomware
- CVE-2013-0640 KEV
- CVE-2013-3893 KEV
- CVE-2014-1776 KEV
- CVE-2014-4113 KEV
- CVE-2014-6332 KEV
- CVE-2015-1641 KEV
- CVE-2015-1701 KEV ransomware
- CVE-2015-2545 KEV
- CVE-2015-5119 KEV
- CVE-2015-8651 KEV
Show all 34 CVEs Show fewer
- CVE-2016-0147
- CVE-2016-0189 KEV ransomware
- CVE-2016-0984 KEV
- CVE-2016-1010 KEV
- CVE-2016-4117 KEV ransomware
- CVE-2016-4171 KEV
- CVE-2017-0199 KEV ransomware
- CVE-2017-11882 KEV ransomware
- CVE-2017-12824
- CVE-2017-5689 KEV
- CVE-2017-8570 KEV
- CVE-2017-8750
- CVE-2017-8759 KEV
- CVE-2018-0798 KEV
- CVE-2018-0802 KEV ransomware
- CVE-2018-8373 KEV
- CVE-2018-8453 KEV ransomware
- CVE-2018-8611 KEV
- CVE-2019-11932
- CVE-2020-1472 KEV ransomware
- CVE-2021-31979 KEV
- CVE-2021-33771 KEV
KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.
Reports
-
Threat Group Cards: A Threat Actor Encyclopedia
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia
-
WINDSHIFT_summit_archive_1554718868
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor WINDSHIFT_summit_archive_1554718868
-
Bahamut cybermercenary group targets Android users with fake VPN apps
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Bahamut cybermercenary group targets Android users with fake VPN apps
-
Bahamut Android Malware Returns With New Spying Capabilities
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Bahamut Android Malware Returns With New Spying Capabilities
Show all 51 reports Show fewer
-
Recent attacks by Bahamut group revealed
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Recent attacks by Bahamut group revealed
-
Mercenary APTs – An Exploration
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Mercenary APTs – An Exploration
-
StrongPity APT Group Deploys Android Malware for the First Time
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor StrongPity APT Group Deploys Android Malware for the First Time
-
Bahamut Possibly Responsible for Multi-Stage Infection Chain Campaign
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Bahamut Possibly Responsible for Multi-Stage Infection Chain Campaign
-
report-bb-2021-threat-report.pdf
The original link failed its last check. Original publisher Detailsfor report-bb-2021-threat-report.pdf
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor report-spark-bahamut
-
BAHAMUT- Hack-for-Hire Masters of Phishing, Fake News, and Fake Apps
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor BAHAMUT- Hack-for-Hire Masters of Phishing, Fake News, and Fake Apps
-
Cyber espionage in the Middle East- unravelling OSX.WindTail
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Cyber espionage in the Middle East- unravelling OSX.WindTail
-
Group-IB_Hi-Tech_Crime_Trends_2019-2020_en
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Group-IB_Hi-Tech_Crime_Trends_2019-2020_en
-
Group-IB_Hi-Tech_Crime_Trends_2019-2020
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Group-IB_Hi-Tech_Crime_Trends_2019-2020
-
Threat Group Cards: A Threat Actor Encyclopedia
The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Threat Group Cards: A Threat Actor Encyclopedia
-
Threat Group Cards: A Threat Actor Encyclopedia
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia
-
Shifting in the Wind- WINDSHIFT Attacks Target Middle Eastern Governments
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Shifting in the Wind- WINDSHIFT Attacks Target Middle Eastern Governments
-
analyzing WindShift implant OSX.WindTail
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor analyzing WindShift implant OSX.WindTail
-
Middle East Cyber-Espionage- analyzing WindShift's implant- OSX.WindTail (part 1)
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Middle East Cyber-Espionage- analyzing WindShift's implant- OSX.WindTail (part 1)
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Analysis Of Targeted Attack Against Pakistan By Exploiting InPage Vulnerability And Related APT Groups
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor EN_version
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor CN_version
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Confucius Update: New Tools and Techniques, Further Connections with Patchwork - TrendLabs Security Intelligence Blog
-
Hackers Are Exposing An Apple Mac Weakness In Middle East Espionage
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Hackers Are Exposing An Apple Mac Weakness In Middle East Espionage
-
HITB-SG-2018-E - In the trails of WINDSHIFT [Autosaved]
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor HITB-SG-2018-E - In the trails of WINDSHIFT [Autosaved]
-
The Urpage Connection to Bahamut, Confucius and Patchwork
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The Urpage Connection to Bahamut, Confucius and Patchwork
-
The Urpage Connection to Bahamut, Confucius and Patchwork
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Urpage Connection to Bahamut, Confucius and Patchwork
-
Bahamut, Confucius and Patchwork Connected to Urpage
The original link failed its last check. Original publisher Detailsfor Bahamut, Confucius and Patchwork Connected to Urpage
-
Appendix-TheUrpageConnectiontoBahamutConfuciusandPatchwork
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Appendix-TheUrpageConnectiontoBahamutConfuciusandPatchwork
-
Bahamut Revisited, More Cyber Espionage in the Middle East and South Asia
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Bahamut Revisited, More Cyber Espionage in the Middle East and South Asia
-
bellingcat - Bahamut Revisited, More Cyber Espionage in the Middle East and South Asia - bellingcat
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor bellingcat - Bahamut Revisited, More Cyber Espionage in the Middle East and South Asia - bellingcat
-
Bahamut, Pursuing a Cyber Espionage Actor in the Middle East
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Bahamut, Pursuing a Cyber Espionage Actor in the Middle East
Newest first. Details opens the report in Explore.