🇨🇳

The White Company

APT Group Information theft and espionage 46 zero-day CVEs ETDA ✓

Also Known As

No alias recorded

Target Countries 17

Countries highlighted in red

United Arab Emirates Czech Republic Germany Greece Israel India Kyrgyzstan Kazakhstan Former Yugoslav Republic of Macedonia Mongolia Pakistan Poland Slovenia Turkey Ukraine United States Uzbekistan

Sectors Targeted

Public Administration 92 Space Research and Technology 927 Computer Systems Design and Related Services 5415 NAICS:48 48 Government Information 51 Defense National Security and International Affairs 928 Utilities 22

Details

Origin 🇨🇳 CN

Last Updated 11 May 2024

Malware Families 3

NETWIRE

REVENGERRAT

revenge_rat

MITRE ATT&CK 15

T1027 T1027.002 T1059.001 T1070 T1070.004 T1071.001 T1124 T1203 T1204 T1204.002 T1518 T1518.001 T1566 T1566.001 T1569.002

Related Zero-Days 46

CVE-2017-0144 CVE-2021-26855 CVE-2021-26857 CVE-2021-26858 CVE-2021-27065 CVE-2021-40539 CVE-2021-44228 CVE-2022-26134 CVE-2022-42475 CVE-2023-20198 CVE-2023-36025 CVE-2024-1086 CVE-2024-21412 CVE-2024-29988 CVE-2024-38112 CVE-2024-39717 CVE-2024-43461 CVE-2024-47575 CVE-2024-50623 CVE-2025-20333 CVE-2025-20362 CVE-2025-20363 CVE-2025-22224 CVE-2025-22225 CVE-2025-22226 CVE-2025-24085 CVE-2025-24201 CVE-2025-24983 CVE-2025-24984 CVE-2025-24985 CVE-2025-24991 CVE-2025-24993 CVE-2025-26633 CVE-2025-27363 CVE-2025-29824 CVE-2025-41236 CVE-2025-41237 CVE-2025-41238 CVE-2025-41239 CVE-2025-49704 CVE-2025-53770 CVE-2025-53771 CVE-2025-54309 CVE-2025-59287 CVE-2025-9242 CVE-2025-9491

Known Names 2 entries

The White Company Cylance

G0089 MITRE

Observed Target Countries 1

Based on ETDA data — countries highlighted in red

Pakistan

Description

(Cylance) Cylance has determined that Operation Shaheen was an espionage campaign executed over the course of the last year. It was a targeted campaign which appeared to focus on individuals and organizations in Pakistan, specifically the government and the military. Cylance’s window into this campaign, though significant, is not all-encompassing. Indeed, our research revealed evidence that The White Company conducted extensive prior reconnaissance of its targets, and continues to operate largely unnoticed by the security community.

Operations 1

2017-11 Operation “Shaheen” We have dubbed the first campaign Operation Shaheen. It examines a complex espionage effort directed at the Pakistani military.

Reports & References 1

https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/WhiteCompanyOperationShaheenReport.pdf

ETDA Profile

The White Company

Origin

[Unknown]

First Seen 2017

Sponsor State-sponsored

Motivation

Information theft and espionage

MITRE ATT&CK Groups

https://attack.mitre.org/groups/G0089/

View on ETDA APT Groups ↗