Whitefly

Executive Summary

Whitefly is a cyber espionage group targeting healthcare, telecommunications, and media sectors primarily in Singapore since 2017. Their primary motive is to steal sensitive information, as evidenced by their attack on SingHealth, Singapore's largest public health organization.

Goals & Targeting

Whitefly's primary objective is to steal sensitive information, particularly from healthcare institutions, although their targeting has expanded to include media and telecommunications sectors in Singapore. The group's focus on these industries suggests an interest in both personal data and potentially strategic information that could impact national security. Their victims are typically high-value targets with access to classified or proprietary information.

Whitefly operates as a sophisticated cyber espionage group with a focus on extracting sensitive data from targeted organizations. The group has predominantly targeted entities in Singapore across various sectors including healthcare, telecommunications, and media. Their activities have been linked to the breach of SingHealth, which resulted in one of the most significant healthcare cyber attacks in Singapore's history. Whitefly employs a variety of tactics, techniques, and procedures (TTPs) to achieve their objectives, including the use of malicious software and encrypted communication channels. The group's operations demonstrate a high level of planning and technical expertise, making them a notable threat to organizations handling sensitive information. Their targeting strategy appears to be driven by the goal of obtaining valuable intellectual property and strategic data.

Key Capabilities

• Use of encrypted/encoded files
• Spoofing legitimate resource names or locations
• Malicious file creation
• DLL injection techniques
• Memory dumping attacks
• Command and scripting interpreter usage
• Ingress tool transfer

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Whitefly has been active since at least 2017, with notable operations including the SingHealth breach. Their campaigns frequently target high-profile organizations in Singapore's critical sectors, with a focus on data exfiltration. The group demonstrates advanced capabilities in persistence, lateral movement, and information theft.

IOC Patterns

• Spear-phishing emails
• Encrypted communication channels
• Malicious scripts embedded in documents
• Lateral movement across networks
• C2 communication over HTTPS or DNS

Recommended Actions

• Enhance network monitoring for encrypted and legitimate-looking traffic.
• Implement strict patch management to mitigate known vulnerabilities.
• Conduct regular user training on spear-phishing and social engineering tactics.
• Monitor for unusual lateral movement indicators in network logs.
• Encrypt sensitive data at rest and implement access controls.

Suggested Tags