WindShift

Bahamut, also referred to in the content as Windshift, is a threat actor associated in the provided material with cyberespionage activity and mobile surveillance operations. BlackBerry Research is cited as identifying Bahamut for the use of advanced zero-day exploits and malicious mobile applications targeting diplomats, government officials, and business leaders across the Middle East. The content also states that Bahamut deployed persistent malware implants for long-term covert surveillance and intelligence gathering. The content describes Windshift/Bahamut using spearphishing emails with malicious attachments to harvest credentials and deliver malware, including e-mail attachments used to lure victims into executing malicious code. It also states that Bahamut and Molerats used phishing emails with malicious links and malicious Microsoft Word and PDF attachments for initial access, and that Bahamut also used messaging applications for phishing-based initial access. Persistence tradecraft attributed in the content includes creation of malicious LNK files in Startup-related folders to establish persistence. Post-compromise behavior attributed to Windshift/Bahamut in the content includes identifying the username and computer name on compromised hosts, enumerating active processes, collecting information about target machines via WMI, and using malware for software discovery, including gathering active processes, installed software, and the presence of antivirus products such as Kaspersky, Quick Heal, AVG, BitDefender, Avira, Sophos, Avast, and ESET. The content also states that Windshift used tools that communicate with command-and-control over HTTP and used string encoding with floating point calculations. The content further links Windshift/Bahamut to mobile surveillance campaigns Operation BULL and Operation ROCK. In those operations, malicious apps included SMS message exfiltration, system information enumeration, and video recording. Operation ROCK is specifically described as exfiltrating local account data and calendar information. The content also states that Bahamut uses the publicly available remote administration tools NETWIRE and Revenge RAT. Aliases and naming in the provided content indicate that Windshift and Bahamut refer to the same actor.