Threat Actors Windshift

Windshift

G0112 TLP:CLEAR

Active

Kill Chain Analysis Generate Graph Hunt Package

Also known as: Bahamut, Offshore APT organization from South Asia, Windy Phoenix, tracked as, forecasts, a solitary arcus, KitM OSX, Tech Sectors, Agrius

Description

Windshift is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government departments and critical infrastructure across the Middle East.(Citation: SANS Windshift August 2018)(Citation: objective-see windtail1 dec 2018)(Citation: objective-see windtail2 jan 2019)

Goals & Targeting

Targeted Sectors

Government

Critical infrastructure

Energy

Nuclear

Transportation

Media

Financial services

Maritime

Education

Mining

Non profit

Targeted Countries / Regions

middle_east

AI Analysis

· 1 week ago

Executive Summary

Windshift, also known as Bahamut or Offshore APT, is an advanced persistent threat (APT) group primarily involved in espionage activities targeting Middle Eastern governments and critical infrastructure since at least 2017. The group employs sophisticated tactics including spear-phishing campaigns and malware deployment to achieve its objectives.

Goals & Targeting

Windshift's primary motivation is espionage, targeting Middle Eastern countries for strategic intelligence. The group specifically focuses on government departments and critical infrastructure sectors due to their high-value assets and the potential impact of compromising such entities.

Enhanced Description

Windshift has been actively conducting surveillance operations in the Middle East, focusing on government departments and critical infrastructure sectors. Known for their use of custom tools like WindTail, the group leverages a variety of techniques including system discovery, file obfuscation, and malicious document dissemination to compromise targets. Their operations often involve long-term campaigns aimed at gathering sensitive information, demonstrating a high level of operational persistence.

Key Capabilities

Spear-phishing with attachments
Malicious file distribution
Custom malware (WindTail)
Obfuscation techniques
Registry modifications for persistence

MITRE ATT&CK Tactics

Discovery

Defense Evasion

Credential Access

Collection

Exfiltration

Execution

ATT&CK Techniques

T1047

T1033

T1204.002

T1566.002

T1566.001

T1082

T1036

T1057

T1547.001

T1027

T1036.001

T1518.001

T1189

T1071.001

T1059.005

T1518

T1105

T1204.001

T1566.003

Software / Tooling

WindTail

Campaigns & Victims

Windshift is known for long-term campaigns targeting specific individuals in government and critical infrastructure sectors. Their operations include the use of spear-phishing emails with malicious attachments or links, aiming to maintain persistence on compromised systems.

IOC Patterns

Spear-phishing emails with maliciousattachments
Malicious files dropped during infections
Registry changes for persistence

Recommended Actions

Implement email filtering to detect spear-phishing attempts
Monitor for suspicious file hashes related to WindTail malware
Harden system configurations to prevent arbitrary execution of scripts.
Employ endpoint detection and response (EDR) solutions to monitor for T1047 behavior.
Conduct regular user training on recognizing phishing tactics.

Suggested Tags

APT

espionage

Middle East

Confidence Assessment

Moderate confidence level. While the group's TTPs and targets are well-documented, there is limited visibility into their precise campaign timelines and exact objectives beyond espionage. Additional information on their infrastructure and specific campaigns could enhance understanding.

ATT&CK Techniques

Command & Control

3 techniques

T1071

Application Layer Protocol

T1071.001

Web Protocols

Windshift has used tools that communicate with C2 over HTTP.(Citation: BlackBerry Bahamut)

T1105

Ingress Tool Transfer

Windshift has used tools to deploy additional payloads to compromised hosts.(Citation: BlackBerry Bahamut)

Credential Access

1 technique

T1040

Network Sniffing

Discovery

5 techniques

T1033

System Owner/User Discovery

Windshift has used malware to identify the username on a compromised host.(Citation: BlackBerry Bahamut)

T1057

Process Discovery

Windshift has used malware to enumerate active processes.(Citation: BlackBerry Bahamut)

T1082

System Information Discovery

Windshift has used malware to identify the computer name of a compromised host.(Citation: BlackBerry Bahamut)

T1518

Software Discovery

Windshift has used malware to identify installed software.(Citation: BlackBerry Bahamut)

T1518.001

Security Software Discovery

Windshift has used malware to identify installed AV and commonly used forensic and malware analysis tools.(Citation: BlackBerry Bahamut)

Execution

6 techniques

T1047

Windows Management Instrumentation

Windshift has used WMI to collect information about target machines.(Citation: BlackBerry Bahamut)

T1059

Command and Scripting Interpreter

T1059.005

Visual Basic

Windshift has used Visual Basic 6 (VB6) payloads.(Citation: BlackBerry Bahamut)

T1204

User Execution

T1204.001

Malicious Link

Windshift has used links embedded in e-mails to lure victims into executing malicious code.(Citation: SANS Windshift August 2018)

T1204.002

Malicious File

Windshift has used e-mail attachments to lure victims into executing malicious code.(Citation: SANS Windshift August 2018)

Initial Access

5 techniques

T1189

Drive-by Compromise

Windshift has used compromised websites to register custom URL schemes on a remote system.(Citation: objective-see windtail1 dec 2018)

T1566

Phishing

T1566.001

Spearphishing Attachment

Windshift has sent spearphishing emails with attachment to harvest credentials and deliver malware.(Citation: SANS Windshift August 2018)

T1566.002

Spearphishing Link

Windshift has sent spearphishing emails with links to harvest credentials and deliver malware.(Citation: SANS Windshift August 2018)

T1566.003

Spearphishing via Service

Windshift has used fake personas on social media to engage and target victims.(Citation: SANS Windshift August 2018)

Persistence

2 techniques

T1547

Boot or Logon Autostart Execution

T1547.001

Registry Run Keys / Startup Folder

Windshift has created LNK files in the Startup folder to establish persistence.(Citation: BlackBerry Bahamut)

Resource Development

4 techniques

T1583

Acquire Infrastructure

T1583.001

Domains

T1584

Compromise Infrastructure

T1584.001

Domains

Stealth

14 techniques

T1027

Obfuscated Files or Information

Windshift has used string encoding with floating point calculations.(Citation: BlackBerry Bahamut)

T1036

Masquerading

Windshift has used icons mimicking MS Office files to mask malicious executables.(Citation: objective-see windtail1 dec 2018) Windshift has also attempted to hide executables by changing the file extension to ".scr" to mimic Windows screensavers.(Citation: BlackBerry Bahamut)

T1036.001

Invalid Code Signature

Windshift has used revoked certificates to sign malware.(Citation: objective-see windtail1 dec 2018)(Citation: SANS Windshift August 2018)

T1036.002

Right-to-Left Override

T1036.003

Rename Legitimate Utilities

T1036.004

Masquerade Task or Service

T1036.005

Match Legitimate Resource Name or Location

T1036.006