FORENSIA

THREAT_ACTOR · G0112

Windshift

Also known as: Windshift, Bahamut

Profile

Windshift is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government departments and critical infrastructure across the Middle East.

MITRE ATT&CK ↗

Techniques

19 ATT&CK techniques attributed to this actor.

T1027 Obfuscated Files or InformationT1033 System Owner/User DiscoveryT1036 MasqueradingT1036.001 Invalid Code SignatureT1047 Windows Management InstrumentationT1057 Process DiscoveryT1059.005 Visual BasicT1071.001 Web ProtocolsT1082 System Information DiscoveryT1105 Ingress Tool TransferT1189 Drive-by CompromiseT1204.001 Malicious LinkT1204.002 Malicious FileT1518 Software DiscoveryT1518.001 Security Software DiscoveryT1547.001 Registry Run Keys / Startup FolderT1566.001 Spearphishing AttachmentT1566.002 Spearphishing LinkT1566.003 Spearphishing via Service

Software

1 malware/tools attributed to this actor.

WindTail

Related corpus activity

10,377 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to Windshift.

IndicatorTypeFamilySevSrc
cve-2026-3102cve—853
cve-2026-1969cve—851
cve-2013-3307cve—852
cve-2014-2321cve—851
cve-2025-2492cve—852
cve-2021-29441cve—851
cve-2025-66478cve—852
cve-2021-27076cve—851
cve-2016-15047cve—854
cve-2018-8007cve—851
cve-2021-4045cve—851
cve-2020-22658cve—852
cve-2017-18377cve—851
cve-2021-25646cve—851
cve-2016-5681cve—852
cve-2022-47945cve—851
cve-2025-0921cve—852
cve-2026-22584cve—852
cve-2025-11837cve—852
cve-2025-68670cve—852
cve-2025-34054cve—854
cve-2024-1781cve—851
cve-2025-23304cve—852
cve-2023-44976cveransomware852
cve-2020-17456cve—851
cve-2020-22653cve—852
cve-2025-34117cve—851
cve-2026-4368cveransomware851
cve-2013-7471cve—851
cve-2026-0740cve—851

Showing the top 30 by severity of 10,377.