Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Whitefly · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06

Whitefly

MITRE G0107 ↗

Whitefly — ATT&CK roseWH

attack rose · 9 techniques across 6 tactics

What changed

ledger · newest first
  1. —todaynew CVE1 new CVE: CVE-2016-0051

Analyst brief

misp-galaxy + mitre-attack

In July 2018, an attack on Singapore’s largest public health organization, SingHealth, resulted in a reported 1.5 million patient records being stolen. Until now, nothing was known about who was responsible for this attack. Symantec researchers have discovered that this attack group, which we call Whitefly, has been operating since at least 2017, has targeted organizations based mostly in Singapore across a wide variety of sectors, and is primarily interested in stealing large amounts of sensitive information.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

9 techniques · 6 of 15 tactics

  1. Resource development

    1 technique

  2. Execution

    2 techniques

  3. Privilege escalation

    1 technique

  4. Stealth

    3 techniques

  5. Credential access

    1 technique

  6. Command and control

    1 technique

select a technique

Arsenal

1 tools
Tools
Tools · 1ATT&CK
MimikatzS0002 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs Whitefly is cited as exploiting

none on KEV
  1. CVE-2016-00512026-10-17
    1. “Whitefly has used an open-source tool to exploit a known Windows privilege escalation vulnerability (CVE-2016-0051) on unpatched computers.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

    2. “In order to carry out this operation, it uses publicly available tools, including Mimikatz ( Hacktool.Mimikatz ) and an open-source tool (SHA2: 263dc5a8121d20403beeeea452b6f33d51d41c6842d9d19919def1f1cb13226c) that exploits a known Windows privilege escalation vulnerability ( CVE-2016-0051 ) on unpatched computers.”

      cited as exploiting · named nearby · source: symantec-enterprise-blogs.security.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

4 sources
  1. 1.symantec.com/blogs/threat-intelligence/whitefly-espionage-singapore
  2. 2.reuters.com/article/us-singapore-cyberattack/cyberattack-on-singap…
  3. 3.attack.mitre.org/groups/G0107
  4. 4.symantec-enterprise-blogs.security.com/blogs/threat-intelligence/whitefly-espionage-singapore

Track Whitefly on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.