← All Threat Actors
Threat Actor Profile

The White Company

EHDEVEL G0089 Urpage Windshift
The White Company (G0089) is a sophisticated state-sponsored or mercenary threat actor, frequently linked to the 'Bahamut' hack-for-hire cluster. They specialize in stealthy espionage campaigns targeting government and military organizations, with a primary historical focus on South Asia and the Middle East.
Origin Unknown
Sponsor Unknown (linked to Bahamut hack-for-hire operations)
Motivation Geopolitical Espionage

Target Sectors

Government Military Defense

Known TTPs

Spear-phishing
Malicious Word attachments
Custom payload packing (UPX)
Indicator removal (File deletion)
System time discovery (T1124)
User execution of malicious files

External Resources

CISA Advisories ↗

Related Intelligence

Hacking the mainframe…

LINK COPIED TO CLIPBOARD