Introduction
Windshift is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government departments and critical infrastructure across the Middle East. SANS Windshift August 2018 objective-see windtail1 dec 2018 objective-see windtail2 jan 2019
Activities and Tactics
Country of Origin: 🏳️ [“[Unknown]”]
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
- T1057 Process Discovery
- T1189 Drive-by Compromise
- T1059.005 Visual Basic
- T1518.001 Security Software Discovery
- T1566.001 Spearphishing Attachment
- T1204.001 Malicious Link
- T1566.003 Spearphishing via Service
- T1547.001 Registry Run Keys / Startup Folder
- T1518 Software Discovery
- T1566.002 Spearphishing Link
- T1036.001 Invalid Code Signature
- T1027 Obfuscated Files or Information
- T1071.001 Web Protocols
- T1036 Masquerading
- T1105 Ingress Tool Transfer
- T1047 Windows Management Instrumentation
- T1033 System Owner/User Discovery
- T1082 System Information Discovery
- T1204.002 Malicious File
- T1636.003 Contact List
- T1633.001 System Checks
- T1628.003 Conceal Multimedia Files
- T1420 File and Directory Discovery
- T1429 Audio Capture
- T1533 Data from Local System
- T1512 Video Capture
- T1426 System Information Discovery
- T1636.004 SMS Messages
- T1417.001 Keylogging
- T1632.001 Code Signing Policy Modification
- T1430 Location Tracking
- T1406 Obfuscated Files or Information
- T1476 Deliver Malicious Application via Other Means
- T1521.001 Symmetric Cryptography
- T1627.001 Geofencing
- T1407 Download New Code at Runtime
ATT&CK technique IDs (denormalized)
- T1027
- T1033
- T1036
- T1036.001
- T1047
- T1057
- T1059.005
- T1071.001
- T1082
- T1105
- T1189
- T1204.001
- T1204.002
- T1406
- T1407
- T1417.001
- T1420
- T1426
- T1429
- T1430
- T1476
- T1512
- T1518
- T1518.001
- T1521.001
- T1533
- T1547.001
- T1566.001
- T1566.002
- T1566.003
- T1627.001
- T1628.003
- T1632.001
- T1633.001
- T1636.003
- T1636.004
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
- WindTail:
- WindTape:
MITRE ATT&CK Software
Attribution and Evidence
Country of Origin: [“[Unknown]”] Additional attribution information pending cataloguing.
References
[1] mitre-attack [3] SANS Windshift August 2018 Karim, T. (2018, August). TRAILS OF WINDSHIFT. Retrieved November 17, 2024. [4] objective-see windtail1 dec 2018 Wardle, Patrick. (2018, December 20). Middle East Cyber-Espionage analyzing WindShift’s implant: OSX.WindTail (part 1). Retrieved October 3, 2019. [5] objective-see windtail2 jan 2019 Wardle, Patrick. (2019, January 15). Middle East Cyber-Espionage analyzing WindShift’s implant: OSX.WindTail (part 2). Retrieved October 3, 2019.