Windshift has included file enumeration in the malicious apps deployed as part of Operation BULL and Operation ROCK.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1430|Location Tracking|

Windshift has included location tracking capabilities in the malicious apps deployed as part of Operation BULL and Operation ROCK.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1426|System Information Discovery|

Windshift has included system information enumeration in the malicious apps deployed as part of Operation BULL and Operation ROCK.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1429|Audio Capture|

Windshift has included phone call and audio recording capabilities in the malicious apps deployed as part of Operation BULL and Operation ROCK.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1627.001|Geofencing|

Windshift has region-locked their malicious applications during their Operation BULL campaign.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1633.001|System Checks|

Windshift has deployed anti-analysis capabilities during their Operation BULL campaign.(Citation: BlackBerry Bahamut)|