aol.pm

Windshift

IntrusionSet · ATTACK:enterprise:G0112

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:G0112",
  "title": "Windshift",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0112",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--afec6dc3-a18e-4b62-b1a4-5510e1a498d1",
  "external_id": "G0112",
  "domain": "enterprise",
  "created": "2020-06-25T17:16:39.168Z",
  "modified": "2026-09-02T18:52:46.473Z",
  "version": "1.1",
  "aliases": [
    "Windshift",
    "Bahamut"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Bahamut"
    },
    {
      "source_name": "SANS Windshift August 2018",
      "url": "https://www.scribd.com/document/661837258/WINDSHIFT-summit-archive-1554718868"
    },
    {
      "source_name": "objective-see windtail1 dec 2018",
      "url": "https://objective-see.com/blog/blog_0x3B.html"
    },
    {
      "source_name": "objective-see windtail2 jan 2019",
      "url": "https://objective-see.com/blog/blog_0x3D.html"
    }
  ]
}

Explicit source assertions (20)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0112 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09237e32-a423-4ce3-bb15-4e47848ee7f7

BlackBerry Bahamut

ATTACK:enterprise:G0112 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c3668cf-32c1-420f-a1c0-0c8598360ad8

objective-see windtail1 dec 2018

ATTACK:enterprise:G0112 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--116f105a-ee8c-4544-9164-a0a28a572228

BlackBerry Bahamut

ATTACK:enterprise:G0112 → uses → ATTACK:enterprise:T1518.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a2f3d08-8a75-4ad5-8aba-445d37ebbff8

BlackBerry Bahamut

ATTACK:enterprise:G0112 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ab045b8-35b4-4920-8223-d1a6b8c6ae1e

SANS Windshift August 2018

ATTACK:enterprise:G0112 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2332793b-afd0-407b-a1dc-97c5c7580bcb

SANS Windshift August 2018

ATTACK:enterprise:G0112 → uses → ATTACK:enterprise:T1566.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--241c2c47-3659-4899-bf5b-64f0ed94c916

SANS Windshift August 2018

ATTACK:enterprise:G0112 → uses → ATTACK:enterprise:S0466

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4fb841dd-93d8-404a-8738-5fe19a53c730

SANS Windshift August 2018 · objective-see windtail1 dec 2018 · objective-see windtail2 jan 2019

ATTACK:enterprise:G0112 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6aeeb7e4-fc09-40a6-b071-c04df0f92928

BlackBerry Bahamut

ATTACK:enterprise:G0112 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--715262b6-9d31-4589-ba53-fb5d7be3f1f5

BlackBerry Bahamut

ATTACK:enterprise:G0112 → uses → ATTACK:enterprise:T1566.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--88157c8d-48d7-4114-8783-d22999a8f990

SANS Windshift August 2018

ATTACK:enterprise:G0112 → uses → ATTACK:enterprise:T1036.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--893c9a7a-7f2c-4b96-877e-06870d5f989f

SANS Windshift August 2018 · objective-see windtail1 dec 2018

ATTACK:enterprise:G0112 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--996defcb-8a62-4271-9d01-93d66525b159

BlackBerry Bahamut

ATTACK:enterprise:G0112 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aca30dc6-34c2-45f3-87a4-9d9abda01036

BlackBerry Bahamut

ATTACK:enterprise:G0112 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad880548-e776-4e7b-995d-ce6fdc91e865

objective-see windtail1 dec 2018 · BlackBerry Bahamut

ATTACK:enterprise:G0112 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c43ec2e6-3769-4a1c-b99a-2d8988c7a207

BlackBerry Bahamut

ATTACK:enterprise:G0112 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c53a4d1a-7d41-451e-a4f8-4f69ad27ab7d

BlackBerry Bahamut

ATTACK:enterprise:G0112 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--caf951a5-6952-4966-941d-71d9cd598b28

BlackBerry Bahamut

ATTACK:enterprise:G0112 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ea41718b-4215-43d4-8d1f-def88af935e3

BlackBerry Bahamut

ATTACK:enterprise:G0112 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f7800d2b-7eb5-4efe-ac8d-503c187d18ef

SANS Windshift August 2018

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.