WindTail

MITRE ATT&CK: S0466 View on attack.mitre.org

Aliases: WindTail

First seen
2018-07-01 00:00:00
Malware type
spyware
Family
Malware family
Operating systems
macos
Profile updated
2026-07-07 12:56:19

Targeted industries: government-and-public-sector technology-and-telecommunications

Targeted regions: country_code:ae country_code:sa

Context

WindTail is a macOS surveillance implant used by Windshift. WindTail shares code similarities with Hack Back aka KitM OSX.

Detection coverage

  • 180 Sigma rules

Malware & tools used

  • Invalid Code Signature (attack-pattern)
  • Native API (attack-pattern)
  • File and Directory Discovery (attack-pattern)
  • Encrypted/Encoded File (attack-pattern)
  • Web Protocols (attack-pattern)
  • Compression (attack-pattern)
  • Unix Shell (attack-pattern)
  • Automated Collection (attack-pattern)
  • Masquerading (attack-pattern)
  • Archive via Utility (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)
  • File Deletion (attack-pattern)
  • Exfiltration Over Unencrypted Non-C2 Protocol (attack-pattern)
  • Hidden Window (attack-pattern)
  • System Time Discovery (attack-pattern)

Used by threat actors

Reports & references

  • gsec.hitb.org — D1%20Commsec%20 %20In%20The%20Trails%20Of%20Windshift%20Apt%20 %20Taha%20Karim (report)
  • objective-see.com — Blog 0X3B (report)
  • objective-see.com — Blog 0X3D (report)
  • scribd.com — Windshift Summit Archive 1554718868 (report)
  • posts.specterops.io — Introducing Venator A Macos Tool For Proactive Detection 34055A017E56 (report)
  • malpedia.caad.fkie.fraunhofer.de — Osx.Windtail (report)
  • virusbulletin.com — Vb2019 Paper Cyber Espionage Middle East Unravelling Osxwindtail (report)
  • forbes.com — Apple Mac Loophole Breached In Middle East Hacks (report)
  • sans.org — Summit Archive 1554718868 (report)
  • MITRE ATT&CK — S0466 (report)

External references