- Category
- Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
- Origin
- Unknown
- Motivation
- Information theft and espionage
- Seen
- 2016–2026
- Status
- Active
- ATT&CK
- G0112 · 36 techniques
- Sources
- 9 sources carry it
- Identifier
- GINC-APT-0105 · windshift
What it is
Windshift is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government departments and critical infrastructure across the Middle East.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- MITRE ATT&CK
- G0112
- Other names
- Bahamut, Windy Phoenix
Targets
- Countries
- Egypt, Iran, Pakistan, Palestine, Qatar, Tunisia, Türkiye, United Arab Emirates
- Sectors
- Government
Tools
The tools and malware families the sources tie to it.
- WindTail
- WindTape
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de