Windshift has used revoked certificates to sign malware.(Citation: objective-see windtail1 dec 2018)(Citation: SANS Windshift August 2018)|
|mitre-attack|enterprise-attack,mobile-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Windshift has sent spearphishing emails with attachment to harvest credentials and deliver malware.(Citation: SANS Windshift August 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

Windshift has sent spearphishing emails with links to harvest credentials and deliver malware.(Citation: SANS Windshift August 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows,Containers|T1036|Masquerading|

Windshift has used icons mimicking MS Office files to mask malicious executables.(Citation: objective-see windtail1 dec 2018)

Windshift has also attempted to hide executables by changing the file extension to ".scr" to mimic Windows screensavers.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

Windshift has used links embedded in e-mails to lure victims into executing malicious code.(Citation: SANS Windshift August 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Windshift has used e-mail attachments to lure victims into executing malicious code.(Citation: SANS Windshift August 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1533|Data from Local System|

Windshift has exfiltrated local account data and calendar information as part of Operation ROCK.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1512|Video Capture|