Loading threat actor…
Whitefly is a threat actor assessed as state-sponsored and associated with the 2018 SingHealth breach in Singapore. Its documented targeting includes Singapore's healthcare sector; its country of origin is not established. Whitefly uses publicly available tools alongside techniques for credential theft, privilege escalation, and payload concealment. It has obtained and used Mimikatz to extract credentials from compromised Windows systems. It has also used an open-source tool to exploit CVE-2016-0051, a Windows privilege-escalation vulnerability, on unpatched computers. The group encrypts payloads used for command-and-control activity to obscure their contents and hinder detection or analysis.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
39 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
3 malware families Mallory has associated with this actor across public reporting.
4 CVEs Mallory has associated with this actor across public reporting. 4 of them are exploited in the wild (not necessarily by this actor).
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.