Shifting in the Wind: WINDSHIFT Attacks Target Middle Eastern Governments
Summary: Unit 42 correlated WINDSHIFT activity against a Middle Eastern government agency between January and May 2018, starting with an inbound WINDTAIL backdoor sample sent from IP 109.235.51[.]110 to a single internal address. All related samples were Mac OSX app bundles in zip archives, including mcworker.zip, whose command-and-control server was 185.25.50[.]189, resolving at the time to domforworld[.]com.
Why it matters: A single internal IP address absorbed repeated WINDTAIL deliveries from the same external address for five months, and Unit 42 notes it has no insight into how the initial infection was attempted - the actor's TTPs only suggest spearphishing was almost certainly involved.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026