The White Company
IntrusionSet · ATTACK:enterprise:G0089
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0089",
"title": "The White Company",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0089",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--6688d679-ccdb-4f12-abf6-c7545dd767a4",
"external_id": "G0089",
"domain": "enterprise",
"created": "2019-05-02T00:08:18.314Z",
"modified": "2026-07-31T18:47:59.296Z",
"version": "1.1",
"aliases": [
"The White Company"
],
"tactics": [
],
"source_references": [
{
"source_name": "Cylance Shaheen Nov 2018",
"url": "https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/WhiteCompanyOperationShaheenReport.pdf?_ga=2.161661948.1943296560.1555683782-1066572390.1555511517"
}
]
}Explicit source assertions (9)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0089 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2155f707-de4f-4ef1-9982-1af90392af5f
Cylance Shaheen Nov 2018ATTACK:enterprise:G0089 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2a8c6029-7714-437a-87a2-bc91067575e6
Cylance Shaheen Nov 2018ATTACK:enterprise:G0089 → uses → ATTACK:enterprise:T1203
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--49315e80-2d47-432f-8e5f-3a694a91bb45
Cylance Shaheen Nov 2018ATTACK:enterprise:G0089 → uses → ATTACK:enterprise:S0379
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--852e45c7-0d49-43ff-b15c-dd4f6d51703f
Cylance Shaheen Nov 2018ATTACK:enterprise:G0089 → uses → ATTACK:enterprise:S0198
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8abfac45-26c2-493f-a4f3-3fb4d196712f
Cylance Shaheen Nov 2018ATTACK:enterprise:G0089 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9d42a47f-ccdc-42f0-9551-11bf5e2a9616
Cylance Shaheen Nov 2018ATTACK:enterprise:G0089 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e3d8a792-5c54-4e37-9ce1-6a8555e76a03
Cylance Shaheen Nov 2018ATTACK:enterprise:G0089 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eba54c2a-854f-4349-9248-314519ed9c43
Cylance Shaheen Nov 2018ATTACK:enterprise:G0089 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f368f221-bcd5-400d-b350-83173de26423
Cylance Shaheen Nov 2018