← All actors Recent activity

Windshift G0112

BAHAMUT · WINDSHIFT

Indicators
210
Source reports
59
Activity span
not dated
Newest indicator
unknown
Upstream change
2026-06-26
20182026

Overview 210 indicators

Windshift is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government departments and critical infrastructure across the Middle East.

domain186G0112-domain.txt
ipv414G0112.json
url_path8G0112.json
url2G0112.json

Techniques 35 ATT&CK

Open in ATT&CK Navigator → or download the layer (35 techniques, layer 4.5)

Software 1

Principal sources 59 reports

Ranked by how many of this actor's indicators each report brought in.

What the sources have in common — not a claim that these are the same actor. See the whole graph.

Timeline 210 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

  1. 11 domainthis year

    x.com/malwrhunterteam/status/2070466586591313… · tria.ge/260626-nf8lxsax8v/behavioral1 · virustotal.com/gui/file/833eb2907cbf002c325356a4025a57…

    dev-demo.click
    docreader.icu
    doctor-reader.icu
    dservices.space
    dsharedservices.xyz
    marketing-bmut.icu
    painel.dev-demo.click
    painel.marketing-bmut.icu
    painel.smspro.click
    pdfreader.help
    smspro.click

  2. 3 domain, 3 ipv42 yrs ago

    x.com/malwrhunterteam/status/1826580072645431… · virustotal.com/gui/file/701016a39ff5656b6a7e6cf17a6ae0… · virustotal.com/gui/file/b8e797526a4d22ddfe0d9cf97a2426…

    domainoha.alpinemap.net
    domainsrv.psyberia.org
    domainxyz.psyberia.org
    ipv4162.55.103.211:20121
    ipv4162.55.103.211:20122
    ipv4162.55.103.211:20123

  3. 1 ipv43 yrs ago

    threatfox.abuse.ch/browse/malware/apk.bahamut

    134.255.231.233:8443

  4. 1 url3 yrs ago

    welivesecurity.com/en/eset-research/unlucky-kamran-android… · otx.alienvault.com/pulse/6552657c0e444a423248f10c · virustotal.com/gui/file/8609ce3bd3f395a25f3a2e2e343eb3…

    hunzanews.net/wp-content/uploads/apk/

  5. 7 domain3 yrs ago

    twitter.com/0x6rsk/status/1656554067160702982 · twitter.com/BaoshengbinCumt/status/1656577909224796… · about.fb.com/wp-content/uploads/2023/05/Meta-Quarter… · virustotal.com/gui/file/0a7a9a3e5915f390e8a0d89c0ec21d… · virustotal.com/gui/file/672d56b13708752b9d5287a8ac5e06…

    hbx5adg6vk.de
    khalsaforum.com
    mamoonchat.com
    play-store-secure-safechat.usmimedia.com
    punjab-news18media-tribuneindia-mail.usmimedia.com
    rwzj2nntc3.de
    usmimedia.com

  6. 1 url3 yrs ago

    twitter.com/malwrhunterteam/status/1595141450177871… · twitter.com/midnight_comms/status/15961568303630295… · twitter.com/midnight_comms/status/15965663035981824… · cyfirma.com/outofband/apt-bahamut-attacks-indian-in… · virustotal.com/gui/file/45a6a0b2b02a9d288afba1ff41c689… · virustotal.com/gui/file/a2abdf1d3439c9598f76c3732770b9…

    http://45.156.84.129

  7. 5 domain, 3 ipv43 yrs ago

    twitter.com/malwrhunterteam/status/1616145101343817… · twitter.com/dyngnosis/status/1616149602578595846 · virustotal.com/gui/file/0d7c1dffbd5abab02c174836cf1075… · virustotal.com/gui/file/38d0804412c47a77f08ecb346df27a…

    domainfvbyavgyea.com
    domainjkiohreh.com
    domainrondwsign.com
    domaintokenmajorp.com
    domainvarweregofo.com
    ipv4162.55.103.212:20121
    ipv4162.55.103.212:20122
    ipv4162.55.103.212:20123

  8. 1 domain, 3 ipv44 yrs ago

    twitter.com/malwrhunterteam/status/1595141450177871… · twitter.com/midnight_comms/status/15961568303630295… · twitter.com/midnight_comms/status/15965663035981824… · cyfirma.com/outofband/apt-bahamut-attacks-indian-in… · virustotal.com/gui/file/45a6a0b2b02a9d288afba1ff41c689… · virustotal.com/gui/file/a2abdf1d3439c9598f76c3732770b9…

    domaincdw1ir0dc9g3dwl5oh1y.de
    ipv4194.156.88.235:5000
    ipv445.156.84.129:3000
    ipv445.156.85.161:2096

  9. 1 ipv44 yrs ago

    twitter.com/malwrhunterteam/status/1595141450177871… · twitter.com/midnight_comms/status/15961568303630295… · twitter.com/midnight_comms/status/15965663035981824… · cyfirma.com/outofband/apt-bahamut-attacks-indian-in… · virustotal.com/gui/file/45a6a0b2b02a9d288afba1ff41c689… · virustotal.com/gui/file/a2abdf1d3439c9598f76c3732770b9…

    14.16.88.35:5000

  10. 1 domain4 yrs ago

    twitter.com/malwrhunterteam/status/1595141450177871… · twitter.com/midnight_comms/status/15961568303630295… · twitter.com/midnight_comms/status/15965663035981824… · cyfirma.com/outofband/apt-bahamut-attacks-indian-in… · virustotal.com/gui/file/45a6a0b2b02a9d288afba1ff41c689… · virustotal.com/gui/file/a2abdf1d3439c9598f76c3732770b9…

    96r1yh643o.de

  11. 1 domain4 yrs ago

    twitter.com/m0br3v/status/1570415612014530562 · virustotal.com/gui/file/c5f29fcb69ffaaac4568b0607d94bc…

    newshostpoint.co

  12. 1 domain4 yrs ago

    twitter.com/Des00464472/status/1567097126999703553 · virustotal.com/gui/ip-address/5.249.160.150/relations

    32e6dwbbpg.de

  13. 2 domain4 yrs ago

    twitter.com/Des00464472/status/1552146340515561472 · virustotal.com/gui/ip-address/5.249.160.136/relations

    ay3a9j7pc3.de
    yu27izuchc.de

  14. 3 domain, 3 ipv44 yrs ago

    twitter.com/malwrhunterteam/status/1539985809184641… · twitter.com/malwrhunterteam/status/1540332848577667… · virustotal.com/gui/ip-address/193.23.161.164/relations · virustotal.com/gui/file/1084b7ff4758b5d13dcfc4f9167b16…

    domainfjasfjfas89e.gkcx6ye4t4zafw8ju2xdr5na5.de
    domaingkcx6ye4t4zafw8ju2xdr5na5.de
    domainiminglechat.de
    ipv4172.64.168.30:2053
    ipv4172.64.168.30:8443
    ipv4193.23.161.164:8443

  15. 1 url_path4 yrs ago

    x.com/malwrhunterteam/status/2070466586591313… · tria.ge/260626-nf8lxsax8v/behavioral1 · virustotal.com/gui/file/833eb2907cbf002c325356a4025a57…

    /ChatService_master.apk

  16. 4 url_path4 yrs ago

    x.com/malwrhunterteam/status/2070466586591313… · tria.ge/260626-nf8lxsax8v/behavioral1 · virustotal.com/gui/file/833eb2907cbf002c325356a4025a57…

    /Kashmir-Youth.apk
    /Kashmir.apk
    /securechatnow_v1_0_6.apk
    /securechatnow_v1_0_7.apk

  17. 4 domain4 yrs ago

    mp.weixin.qq.com/s/YAAybJBAvxqrQWYDg31BBw?_x_tr_sl=zh-CN… · otx.alienvault.com/pulse/625591f0fdef5bd852d84afe

    5iw68rugwfcir37uj8z3r6rfaxwd8g8cdcfcqw62.de
    freesexvideos.ch
    h94xnghlldx6a862moj3.de
    securechatnow.com

  18. 1 domain4 yrs ago

    twitter.com/malwrhunterteam/status/1504892577975259… · twitter.com/midnight_comms/status/15965638520359034… · welivesecurity.com/2022/11/23/bahamut-cybermercenary-group… · otx.alienvault.com/pulse/63809fb03dacd453ae69d37b · virustotal.com/gui/file/a40c7cabf874517f5d3d069e0377fa… · virustotal.com/gui/file/a71290070f826292c0ce907f21280e…

    thesecurevpn.com

  19. 1 domain4 yrs ago

    twitter.com/malwrhunterteam/status/1504892577975259… · twitter.com/midnight_comms/status/15965638520359034… · welivesecurity.com/2022/11/23/bahamut-cybermercenary-group… · otx.alienvault.com/pulse/63809fb03dacd453ae69d37b · virustotal.com/gui/file/a40c7cabf874517f5d3d069e0377fa… · virustotal.com/gui/file/a71290070f826292c0ce907f21280e…

    ft8hua063okwfdcu21pw.de

  20. 1 domain, 2 url_path4 yrs ago

    twitter.com/m0br3v/status/1502262179390758913 · virustotal.com/gui/file/c921363c790c2eb82ab009f94ac096…

    domaindatahost.click
    url_path/jkRt5e/
    url_path/jkRt5e/check.php

  21. 1 domain4 yrs ago

    virustotal.com/gui/domain/ie-settings.com/detection

    ie-settings.com

  22. 1 domain4 yrs ago

    virustotal.com/gui/file/815466ec21c59f7704f094a0e4cfc4…

    lepze.com

  23. 1 domain5 yrs ago

    twitter.com/m0br3v/status/1413076245152141316 · virustotal.com/gui/file/73b516a0a3996ec1c685ad3d8e26a7…

    onlinedomain.link

  24. 3 domain5 yrs ago

    twitter.com/Circuitous__/status/1377767299709550593 · pastebin.com/9U57CHZn

    fastfiterzone.com
    memoadvicr.com
    zovwelle.com

  25. 1 domain5 yrs ago

    twitter.com/bl4ckh0l3z/status/1321746458308128769 · virustotal.com/gui/file/cef4be533954e5bb901080cbca2697… · virustotal.com/gui/file/4fd441183ffd576aea2cf50b19d263…

    procompass.org

  26. 1 domain6 yrs ago

    twitter.com/bl4ckh0l3z/status/1321746458308128769 · virustotal.com/gui/file/cef4be533954e5bb901080cbca2697… · virustotal.com/gui/file/4fd441183ffd576aea2cf50b19d263…

    voiceofislam.info

  27. 117 domain6 yrs ago

    blackberry.com/us/en/pdfviewer?file=/content/dam/black… · otx.alienvault.com/pulse/5f7dd394005536c84adbaf56

    account-googie.com
    accountvalidate.com
    airfitgym.com
    ambicluster.com
    aspnet.dyndns.info
    aspnet.dyndns.infoassurecom.info
    assurecom.info
    bulletinalerts.com
    by4mode.com
    cdn-icloud.co
    cdn-icloud.cocelebsnightmares.com
    celebsnightmares.com
    citrusquad.com
    classmunch.com
    cloud-authorize.com
    cocahut.com
    cocelebsnightmares.com
    cocoka.info
    cocoka.infocrawloofle.com
    cohealthclubfun.com
    crawloofle.com
    cyroonline.com
    devicesupport-rnicrosoft.com
    electrobric.com
    everification-session-load.com
    freepunjab2020.info
    frexinq.com
    gateway-yahoo.com
    ghelp.co
    ghelp.cohealthclubfun.com
    healthclubfun.com
    hypforever.com
    i3mode.com
    imging.site
    imging.siteinlineirnage.com
    infoassurecom.info
    infocrawloofle.com
    inlineirnage.com
    justsikhthings.com
    kannat.ns01.us
    kannat.ns01.uskhalistanlehar.com
    khalistanlehar.com
    leastinfo.com
    leelee.dnset.com
    lizacorner.com
    login-private.com
    logon-info-gsupport.com
    logstrick.com
    m0-rnaiil-siina-chn-reload.everification-session-load.com
    mail-incc.com
    mail-king.com
    mail-validation.info
    mail.techsprouts.com
    mailinfo-bh.com
    me-yahoo.com
    medieczema.com
    middleeastleaks.com
    mideastleaks.com
    mindcraftstore.com
    musicbandfiles.com
    myaccount-googie.com
    myappie.comyfoodzone.net
    myggl.ioo-auth.net
    netonlinetokenid.com
    netstring2me.com
    onlinetokenid.com
    opticscold.com
    opticzstore.com
    optusiy.com
    orgyes2khalistanis.com
    out-look-mail-bh.com
    oyesterclub.info
    passwordsaverr.com
    poiusavid.com
    portal549.com
    privacylog.info
    prontexim.com
    regditogo.com
    rhc-jo.com
    risalaencryptor.com
    rnaiill2-rnaill-slna-m0.everification-session-load.com
    rnail-appld-oath-varfiction.everification-session-load.com
    scan8t.comsecure-useraccount.com
    service-authorization.com
    setting-secure.com
    shiaar-e-islam.com
    signtabo.com
    sikhforjustice.org
    sikhforjustice.orgsimilerwork.netstring2me.com
    similerwork.net
    sync-tokens.com
    tansyroof.com
    techsprouts.com
    thegogl.com
    tierradom.com
    timesofarab.com
    toysforislam.com
    trailhinder.com
    treemanic.com
    trioganic.com
    user-privacy.com
    uskhalistanlehar.com
    uyghuri.51vip.biz
    uyghuri.51vip.bizuyghurie.51vip.bizuygur.5166.info
    uyghurie.51vip.biz
    uygur.5166.info
    uygur.51vip.biz
    uygur.51vip.bizuygur.eicp.netuygur.xicp.netvlprnaiill2-rnaill-slna.m0.everification-session-load.com
    uygur.eicp.net
    uygur.xicp.net
    vlprnaiill2-rnaill-slna.m0.everification-session-load.com
    weddnest.com
    yes2khalistan.org
    yes2khalistan.orgyes2khalistanis.com
    yes2khalistanis.com
    yfoodzone.netmyggl.ioo-auth.netonlinetokenid.com
    zhqdgk.com

  28. 1 domain6 yrs ago

    blackberry.com/us/en/pdfviewer?file=/content/dam/black… · otx.alienvault.com/pulse/5f7dd394005536c84adbaf56 · twitter.com/Circuitous__/status/1377767299709550593 · pastebin.com/9U57CHZn

    lobertica.info

  29. 4 domain7 yrs ago

    blog.talosintelligence.com/2018/07/Mobile-Malware-Campaign-uses-Ma…

    hytechmart.com
    nfinx.info
    referfile.com
    twitck.com

  30. 1 domain7 yrs ago

    blackberry.com/us/en/pdfviewer?file=/content/dam/black… · otx.alienvault.com/pulse/5f7dd394005536c84adbaf56

    traxbin.com

  31. 1 domain7 yrs ago

    blog.talosintelligence.com/2018/07/Mobile-Malware-Campaign-uses-Ma… · blackberry.com/us/en/pdfviewer?file=/content/dam/black… · otx.alienvault.com/pulse/5f7dd394005536c84adbaf56

    techwach.com

  32. 3 domain7 yrs ago

    blackberry.com/us/en/pdfviewer?file=/content/dam/black… · otx.alienvault.com/pulse/5f7dd394005536c84adbaf56 · unit42.paloaltonetworks.com/shifting-in-the-wind-windshift-attacks-… · gsec.hitb.org/materials/sg2018/D1%20COMMSEC%20-%20In%…

    domforworld.com
    flux2key.com
    string2me.com

  33. 1 url_path7 yrs ago

    unit42.paloaltonetworks.com/shifting-in-the-wind-windshift-attacks-… · gsec.hitb.org/materials/sg2018/D1%20COMMSEC%20-%20In%…

    /skdfhwsdkfksgfuisiseifgygffiw.php

  34. 9 domain8 yrs ago

    blog.talosintelligence.com/2018/07/Mobile-Malware-Campaign-uses-Ma…

    32player.com
    appswonder.info
    capsnit.com
    hiltrox.com
    ios-certificate-update.com
    ios-update-whatsapp.com
    metclix.com
    scrollayer.com
    wpitcher.com

Further reading 63

23 more, and the report behind every indicator, in G0112.json.