FORENSIA

THREAT_ACTOR · G0089

The White Company

Also known as: The White Company

Profile

The White Company is a likely state-sponsored threat actor with advanced capabilities. From 2017 through 2018, the group led an espionage campaign called Operation Shaheen targeting government and military organizations in Pakistan.

MITRE ATT&CK ↗

Techniques

7 ATT&CK techniques attributed to this actor.

T1027.002 Software PackingT1070.004 File DeletionT1124 System Time DiscoveryT1203 Exploitation for Client ExecutionT1204.002 Malicious FileT1518.001 Security Software DiscoveryT1566.001 Spearphishing Attachment

Software

2 malware/tools attributed to this actor.

NETWIRERevenge RAT

Related corpus activity

8,521 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to The White Company.

IndicatorTypeFamilySevSrc
cve-2025-12057cve—851
cve-2021-29441cve—851
cve-2024-1781cve—851
cve-2026-3844cve—851
cve-2017-17215cve—852
cve-2026-1969cve—851
cve-2025-0921cve—852
cve-2025-68670cve—852
cve-2023-44976cveransomware852
cve-2026-0740cve—851
cve-2025-7852cve—851
cve-2016-0638cvephishing851
cve-2025-7443cve—851
cve-2025-34085cve—851
cve-2025-23304cve—852
cve-2025-66478cve—852
cve-2026-22584cve—852
cve-2021-27076cve—851
cve-2018-8007cve—851
cve-2026-3102cve—853
60972abf5425c191c81bae117f1dedaea13d39bc52f367d5dff9ad1aa4b9c5casha256phishing802
873f1277a42de5c82f869459e7fb7c94554a642bhash—803
62a879b0d1c1649cc72b2b6f61a8f6bd888625ce6e8a7aefe0a0461e4f27c525sha256phishing802
9c44bc9373377831c45dd0ac2661a28ehash—803
9758e76b601798a30d903bf05052a53df80451e5c156548ce9da828f608b6470sha256—801
221a39856b37e3c682f62427f1e6b965b36a2405764689c914672770a01a1fa9sha256—801
22de84e8f29cba932cf65cf4dc1d333cb8b2e468204f97030712bee32691ac3bsha256phishing802
625b6535321d58bb5c613e85332bf731hash—803
5ab41cf20315d2ea1385967d588159873a65ef5581a0b78de06c0d8617894194sha256phishing802
681075027553546c119ec447eb8df84633dcffcehash—803

Showing the top 30 by severity of 8,521.