Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · WindShift · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06

WindShift

  • Windy Phoenix
  • Bahamut

MITRE G0112 ↗

WindShift — ATT&CK roseWI

attack rose · 19 techniques across 6 tactics

Analyst brief

misp-galaxy + mitre-attack

In August of 2018, DarkMatter released a report entitled “In the Trails of WINDSHIFT APT”, which unveiled a threat actor with TTPs very similar to those of Bahamut. Subsequently, two additional articles were released by Objective-See which provide an analysis of some validated WINDSHIFT samples targeting OSX systems. Pivoting on specific file attributes and infrastructure indicators, Unit 42 was able to identify and correlate additional attacker activity and can now provide specific details on a targeted WINDSHIFT attack as it unfolded at a Middle Eastern government agency.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

19 techniques · 6 of 15 tactics

  1. Initial access

    4 techniques

  2. Execution

    4 techniques

  3. Persistence

    1 technique

  4. Stealth

    3 techniques

  5. Discovery

    5 techniques

  6. Command and control

    2 techniques

select a technique

Arsenal

1 malware
Malware
Malware · 1ATT&CK
WindTailS0466 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Take it with you

keyless · no signup

References

7 sources
  1. 1.unit42.paloaltonetworks.com/shifting-in-the-wind-windshift-attacks-target-middle-e…
  2. 2.gsec.hitb.org/materials/sg2018/D1%20COMMSEC%20-%20In%20the%20Trails%…
  3. 3.unit42.paloaltonetworks.com/atoms/windyphoenix
  4. 4.attack.mitre.org/groups/G0112
  5. 5.scribd.com/document/661837258/WINDSHIFT-summit-archive-1554718868
  6. 6.objective-see.com/blog/blog_0x3B.html
  7. 7.objective-see.com/blog/blog_0x3D.html

Track WindShift on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.