Threat Investigation
Request a demo
Other threat group

WindShift

WindShift is classified as other threat group.

Malware families
1
Also known as
1

In August of 2018, DarkMatter released a report entitled “In the Trails of WINDSHIFT APT”, which unveiled a threat actor with TTPs very similar to those of Bahamut. Subsequently, two additional articles were released by Objective-See which provide an analysis of some validated WINDSHIFT samples targeting OSX systems. Pivoting on specific file attributes and infrastructure indicators, Unit 42 was able to identify and correlate additional attacker activity and can now provide specific details on a targeted WINDSHIFT attack as it unfolded at a Middle Eastern government agency.

The group is associated with 1 malware families.

Also known as: Windy Phoenix

Threat Intelligence

Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.

WindShift · Threat actors · Dark Radar