Home/ Threat Actors/ The White Company

🌐The White Company

🌐 The White Company is a tracked threat actor in the Clankerusecase corpus. ??-aligned. Primary motivation: Unknown. We map 14 detection use cases to this actor across 7 MITRE ATT&CK techniques, with 0 threat-intel articles citing them.

View full actor card → All threat actors MITRE ATT&CK group spec (G0089) ↗

14Use cases

0Articles

7Techniques

0IOCs

About this actor (MITRE)

[The White Company](https://attack.mitre.org/groups/G0089) is a likely state-sponsored threat actor with advanced capabilities. From 2017 through 2018, the group led an espionage campaign called Operation Shaheen targeting government and military organizations in Pakistan.(Citation: Cylance Shaheen Nov 2018)

Known aliases

The White Company

Top techniques

T1027.002 · Software Packing T1070.004 · File Deletion T1124 · System Time Discovery

All other tracked techniques

T1203 · Exploitation for Client Execution T1204.002 · Malicious File T1518.001 · Security Software Discovery T1566.001 · Spearphishing Attachment

Detection use cases (14)

The White Company / Operation Shaheen — Office exploit child drops payload then self-deletes (CVE-2012-0158 / Equation Editor chain) AI · profile S The White Company — AV product enumeration from Office-spawned child (Operation Shaheen anti-detection branding logic) AI · profile SΣ Brand-Impersonation Domain Fetch Followed by User-Context Loader Within 10 Minutes MITRE match Developer package install spawning script-host with non-registry C2 within 5 minutes MITRE match Package Manager / Dev-Tool Auto-Execution Triggers Non-Registry Egress or Credential-Store Access MITRE match Package Manager Install Spawning Outbound Egress to Non-Registry Infrastructure Within 5 Minutes MITRE match Package manager lifecycle hook spawns network-fetching shell or runtime MITRE match Service-process parent spawns subprocess containing CLI-argument-injection tokens MITRE match Abnormal Security: malicious email opened MITRE match Email attachment opened from external sender MITRE match Cisco Secure Firewall - Binary File Type Download MITRE match Cisco Secure Firewall - Blocked Connection MITRE match Clear Unallocated Sector Using Cipher App MITRE match Email Attachments With Lots Of Spaces MITRE match