Home / Threat actors / Windshift
Windshift G0112
Also known as: Bahamut
Updated at source on Sep 2, 2026 · View on MITRE ATT&CK
0
associated CVEs
20
Techniques
1
Malware and tools
Windshift is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government departments and critical infrastructure across the Middle East.
Exploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
ATT&CK does not cite CVEs for this group.
Techniques by tactic
Initial Access
T1189 Drive-by CompromiseT1566.001 Spearphishing AttachmentT1566.002 Spearphishing LinkT1566.003 Spearphishing via Service Execution
T1047 Windows Management InstrumentationT1059.005 Visual BasicT1204.001 Malicious LinkT1204.002 Malicious File Persistence
T1547.001 Registry Run Keys / Startup Folder Privilege Escalation
T1547.001 Registry Run Keys / Startup Folder Stealth
T1027 Obfuscated Files or InformationT1036 MasqueradingT1036.001 Invalid Code Signature Discovery
T1033 System Owner/User DiscoveryT1057 Process DiscoveryT1082 System Information DiscoveryT1518 Software DiscoveryT1518.001 Security Software Discovery Command and Control
T1071.001 Web ProtocolsT1105 Ingress Tool Transfer Malware and tools
- WindTailMalwareS0466
© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.