Skip to content

Windshift

IntrusionSet · ATTACK:mobile:G0112

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:mobile:G0112",
  "title": "Windshift",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0112",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--afec6dc3-a18e-4b62-b1a4-5510e1a498d1",
  "external_id": "G0112",
  "domain": "mobile",
  "created": "2020-06-25T17:16:39.168Z",
  "modified": "2026-09-02T18:52:46.473Z",
  "version": "1.1",
  "aliases": [
    "Windshift",
    "Bahamut"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Bahamut"
    },
    {
      "source_name": "SANS Windshift August 2018",
      "url": "https://www.scribd.com/document/661837258/WINDSHIFT-summit-archive-1554718868"
    },
    {
      "source_name": "objective-see windtail1 dec 2018",
      "url": "https://objective-see.com/blog/blog_0x3B.html"
    },
    {
      "source_name": "objective-see windtail2 jan 2019",
      "url": "https://objective-see.com/blog/blog_0x3D.html"
    }
  ]
}

Explicit source assertions (17)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:G0112 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1822e616-ae33-487c-8aa6-4fa81e724184

BlackBerry Bahamut

ATTACK:mobile:G0112 → uses → ATTACK:mobile:T1633.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e7f8995-93ae-41bb-9baf-53178341d93e

BlackBerry Bahamut

ATTACK:mobile:G0112 → uses → ATTACK:mobile:T1628.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3832d2cf-0568-451d-aac9-6fb809fc423d

Cyfirma Bahamut

ATTACK:mobile:G0112 → uses → ATTACK:mobile:T1420

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--383e5b12-061e-45c6-911b-b37187dd9254

BlackBerry Bahamut

ATTACK:mobile:G0112 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3fcd2177-2030-4781-bd19-8b9fa8c6e645

BlackBerry Bahamut

ATTACK:mobile:G0112 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--429a4b02-f774-4b1e-aaef-5fd9c654dd09

BlackBerry Bahamut

ATTACK:mobile:G0112 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4bdda427-2fff-428d-ba19-4bee5d2508e1

BlackBerry Bahamut

ATTACK:mobile:G0112 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6ca3e3d9-2db9-4bed-98a0-417ff1e6a78e

BlackBerry Bahamut

ATTACK:mobile:G0112 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--90d58c65-acb9-4d7b-89b9-f4b35593c861

BlackBerry Bahamut

ATTACK:mobile:G0112 → uses → ATTACK:mobile:T1417.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9858ae0b-140b-4dd2-8ba9-1ef22183dec3

BlackBerry Bahamut

ATTACK:mobile:G0112 → uses → ATTACK:mobile:T1632.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b49ecb71-92b3-4813-be4d-9f8c2aa67ccd

BlackBerry Bahamut

ATTACK:mobile:G0112 → uses → ATTACK:mobile:T1430

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b5590b50-0aaa-4f43-9b29-f17ee717b551

BlackBerry Bahamut

ATTACK:mobile:G0112 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cc4ae06f-0258-4fe9-b63a-334d283e766d

BlackBerry Bahamut

ATTACK:mobile:G0112 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d8ee0bd2-3f05-4fc0-854b-63ee92a293ca

BlackBerry Bahamut

ATTACK:mobile:G0112 → uses → ATTACK:mobile:T1521.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eef4ffb7-892d-4d3f-826c-0b78d1f22671

BlackBerry Bahamut

ATTACK:mobile:G0112 → uses → ATTACK:mobile:T1627.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fd8a4b6d-0e7b-4105-ad7b-576836be6394

BlackBerry Bahamut

ATTACK:mobile:G0112 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ffc82546-f4da-4f47-88ec-b215edb1d695

BlackBerry Bahamut

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.