The White Company is a likely state-sponsored APT group primarily targeting government and military organizations in Pakistan.
The White Company is a likely state-sponsored threat actor with advanced capabilities. It primarily targets government and military organizations in Pakistan. The group leverages spearphishing attachments for initial access, followed by execution via malicious files dropping Revenge RAT and NETWIRE, while employing stealth techniques like software packing and file deletion. Defenders should focus on detecting suspicious email attachments, monitoring for security software discovery attempts, and investigating unusual system time queries.
The White Company is a likely state-sponsored threat actor with advanced capabilities. From 2017 through 2018, the group led an espionage campaign called Operation Shaheen targeting government and military organizations in Pakistan.
Implement email content and attachment behavior monitoring to detect and block suspicious spearphishing attachments.
Implement client software exploitation monitoring and user-executed file behavior analysis to detect and prevent malicious file execution.
Implement file system change monitoring and unpacking techniques to detect packed malware and track deleted files.
Monitor system queries and process behavior to detect system time and security software discovery attempts.
The White Company leverages spearphishing attachments for initial access.
The White Company drops Revenge RAT and NETWIRE malware.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.