Skip to content

Windshift

Windshift is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government departments and critical infrastructure across the Middle East.

ATT&CK ID: G0112
Techniques: 14
Tools: 1

Also tracked as Bahamut

Techniques

Initial Access

Drive-by Compromise Phishing

Execution

Windows Management Instrumentation Command and Scripting Interpreter User Execution

Persistence

Boot or Logon Autostart Execution

Privilege Escalation

Boot or Logon Autostart Execution

Stealth

Obfuscated Files or Information Masquerading

Discovery

System Owner/User Discovery Process Discovery System Information Discovery Software Discovery

Command and Control

Application Layer Protocol Ingress Tool Transfer

Software

WindTail

MITRE ATT&CK All threat actors