WindShift

Bahamut, also referred to in the content as Windshift, is a threat actor associated with phishing-led intrusion activity and both Windows and mobile malware operations. The content describes Bahamut/Windshift using spearphishing emails with malicious attachments to harvest credentials and deliver malware, as well as using messaging applications for phishing-based initial access. On Windows systems, Windshift established persistence by creating LNK files in the Startup folder and used malware to enumerate active processes, identify the computer name, identify the username, and collect information about target machines via WMI. The group used tools that communicated with command-and-control infrastructure over HTTP and employed string encoding with floating point calculations for obfuscation. On mobile platforms, the content links Windshift to Operation BULL and Operation ROCK, where malicious apps included system information enumeration, SMS message exfiltration, and video recording; Operation ROCK also exfiltrated local account data and calendar information. The content also notes Bahamut’s use of the publicly available remote administration tools NETWIRE and Revenge RAT, and states that Bahamut used malware for software discovery, including gathering active processes, installed software, and the presence of antivirus products such as Kaspersky, Quick Heal, AVG, BitDefender, Avira, Sophos, Avast, and ESET. The content places Bahamut alongside other Middle East-linked threat groups in comparative analysis, but does not explicitly attribute a sponsoring state. Known aliases in the content are Bahamut and Windshift.