The White Company

Executive Summary

The White Company is a state-sponsored threat actor with advanced capabilities known for conducting espionage campaigns. They primarily target government and military organizations, focusing on intelligence gathering. Their activities have been linked to Operation Shaheen, which occurred between 2017 and 2018, indicating a persistent and targeted approach.

Goals & Targeting

The White Company's strategic objectives appear to align with those of a state-sponsored actor, likely aiming to gather intelligence for geopolitical or military purposes. They specifically target government and military organizations, suggesting a focus on espionage rather than financial gain or disruption. The targeting of Pakistan during Operation Shaheen indicates a focus on South Asian geopolitical interests.

The White Company is suspected to be a state-sponsored threat actor with advanced capabilities. They are known for conducting espionage campaigns, including Operation Shaheen, which targeted government and military organizations in Pakistan between 2017 and 2018. The group's operations demonstrate sophistication, utilizing tools such as NETWIRE and Revenge RAT. Their primary focus appears to be on intelligence gathering and compromising sensitive information from their targets.

Key Capabilities

• Advanced persistent threat (APT) capabilities
• Use of custom malware (NETWIRE, Revenge RAT)
• Spear-phishing with malicious attachments
• Exploitation of system vulnerabilities

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

The White Company is known for Operation Shaheen, a targeted espionage campaign against Pakistani government and military entities. The group demonstrates persistence, with activity spanning at least two years. Their use of sophisticated malware suggests a high level of resource and development investment. Notable patterns include the use of spear-phishing attachments and malicious files to compromise targets.

IOC Patterns

• Spear-phishing emails with malicious Office document attachments
• Malicious file downloads from compromised websites
• Network activity indicative of C2 communication (e.g., unusual DNS queries)
• Signs of malware installation, including dropped files and registry modifications

Recommended Actions

• Implement advanced email filtering to detect spear-phishing attempts.
• Monitor for unusual network traffic patterns, particularly related to known C2 infrastructure.
• Use endpoint detection and response (EDR) solutions to identify malicious file activity.
• Conduct regular vulnerability assessments on critical systems to mitigate exploitation risks.
• Educate employees about phishing tactics and implement training programs.

Suggested Tags