The White Company - G0089

Created: 2019-05-02T00:08:18.314Z

Modified: 2020-03-30T19:24:52.290Z

Contributors:

Aliases

The White Company

Description

The White Company is a likely state-sponsored threat actor with advanced capabilities. From 2017 through 2018, the group led an espionage campaign called Operation Shaheen targeting government and military organizations in Pakistan.(Citation: Cylance Shaheen Nov 2018)

Techniques Used

The White Company has sent phishing emails with malicious Microsoft Word attachments to victims.(Citation: Cylance Shaheen Nov 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

The White Company has used phishing lure documents that trick users into opening them and infecting their computers.(Citation: Cylance Shaheen Nov 2018)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

The White Company has taken advantage of a known vulnerability in Microsoft Word (CVE 2012-0158) to execute code.(Citation: Cylance Shaheen Nov 2018)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1027.002|Software Packing|

The White Company has obfuscated their payloads through packing.(Citation: Cylance Shaheen Nov 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

The White Company has the ability to delete its malware entirely from the target system.(Citation: Cylance Shaheen Nov 2018)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518.001|Security Software Discovery|