Loading threat actor…
Windshift, also tracked as Bahamut and Windshift APT, is a cyberespionage threat actor associated with targeted credential harvesting, malware delivery, and surveillance. Its operations include individually tailored social engineering against targets in the Middle East and South Asia. In November 2022, it targeted an intelligence operative in India through a malicious Android application delivered over Telegram after several days of trust-building. The actor uses spearphishing links and attachments to harvest credentials and deliver malware, including Microsoft Word and PDF lures. Its desktop tooling includes Visual Basic 6 payloads and the publicly available remote-access tools NETWIRE and Revenge RAT. Documented behaviors include deploying additional payloads, enumerating processes, installed applications and security products, identifying compromised computers, and discovering files and directories. It establishes Windows persistence through Startup-folder shortcuts and conceals malicious executables using Microsoft Office-style icons and screensaver-like extensions. It also employs string encoding based on floating-point calculations to hinder analysis. Windshift's Android spyware impersonates legitimate applications, including secure file-sharing services. It collects contacts, SMS messages, call logs, device identifiers, and precise location information. It abuses Android accessibility functionality to capture keystrokes and messages from communication applications, including Telegram and Signal. Collected information is staged locally before being transmitted to command-and-control infrastructure.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
64 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
14 malware families Mallory has associated with this actor across public reporting.
9 additional families tracked in Mallory.
2 CVEs Mallory has associated with this actor across public reporting. 2 of them are exploited in the wild (not necessarily by this actor).
71 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.