Whitefly

Whitefly is a cyber espionage threat actor associated with long-term intrusions and stealthy post-compromise activity. The group has been linked to operations targeting organizations in Singapore. Whitefly is known for using modular malware and remote access tooling that can download additional payloads from command-and-control infrastructure, enabling multi-stage intrusions and flexible post-exploitation. Operationally, Whitefly has used malicious executable and DLL payloads disguised as benign documents or images to induce execution and reduce suspicion. The group has also employed masquerading by naming malicious DLLs after components associated with legitimate security software vendors. Whitefly has demonstrated use of DLL search order hijacking and related side-loading behavior, including use of a loader referred to as Vcrodat, to execute malicious code through trusted application workflows. Reported tradecraft also includes simple remote shell capability for interactive command execution after compromise. Observed ATT&CK-aligned behaviors attributed to Whitefly include command and scripting interpreter use, exploitation for privilege escalation, and path interception through PATH environment variable abuse. The group’s emphasis on stealth, staged tooling, and covert persistence is consistent with an intelligence-gathering mission rather than financially motivated crime.