Windshift - G0112

Created: 2020-06-25T17:16:39.168Z

Modified: 2021-04-26T14:37:33.234Z

Contributors:

Aliases

Windshift,Bahamut

Description

Windshift is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government departments and critical infrastructure across the Middle East.(Citation: SANS Windshift August 2018)(Citation: objective-see windtail1 dec 2018)(Citation: objective-see windtail2 jan 2019)

Techniques Used

Windshift has created LNK files in the Startup folder to establish persistence.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1047|Windows Management Instrumentation|

Windshift has used WMI to collect information about target machines.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

Windshift has used malware to identify the computer name of a compromised host.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|

Windshift has used malware to identify the username on a compromised host.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

Windshift has used malware to enumerate active processes.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518|Software Discovery|

Windshift has used malware to identify installed software.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|