- Category
- State · Attributed to a state or working for one.
- Origin
- Unknown
- Sponsor
- State-sponsored
- Motivation
- Information theft and espionage
- Seen
- 2017–2026
- Status
- Active
- ATT&CK
- G0089 · 7 techniques
- Sources
- 5 sources carry it
- Identifier
- GINC-APT-0463 · the-white-company
What it is
The White Company is a likely state-sponsored threat actor with advanced capabilities. From 2017 through 2018, the group led an espionage campaign called Operation Shaheen targeting government and military organizations in Pakistan.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- MITRE ATT&CK
- G0089
- Operations
- Operation “Shaheen”
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTno origin
Targets
- Countries
- Pakistan
- Sectors
- Defense, Government
Tools
The tools and malware families the sources tie to it.
- Cyber Eye RAT
- CyberGate
- NETWIRE
- Revenge RAT
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th