Actors/Hacktivist/Unattributed

Bahamut

G0147HACK?? · Unattributed

AKA Urpage · Windshift

MITRE: G0147

Bahamut is a sophisticated cyber-mercenary APT group active since at least 2016, operating across South Asia and the Middle East and offering espionage-for-hire services to a range of clients including suspected state sponsors. The group conducts targeted spear-phishing campaigns, deploys custom malware, and leverages fake applications and websites to compromise both Windows and mobile devices. Their targets span government entities, military personnel, journalists, activists, and private individuals, with operations driven by financial gain and the intelligence requirements of their paying clients.

Targets0

Sectors4

Threat types1

GIRs covered7/480

Active since2016

Victimology

Geographic footprint · 0 countries

origin · unattributedtargeted countries · 0

No targets recorded for this actor.

REGIONSMiddle East & North Africa

Sectors targeted

4 of 40

Government83 actors Defense60 actors Media & Journalism41 actors Energy1 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 16 techniques

Initial Access · 4

T1189Drive-by Compromise T1566.001Spearphishing Attachment T1566.002Spearphishing Link T1566.003Spearphishing via Service

Execution · 3

T1047Windows Management Instrumentation

Persistence · 1

Discovery · 3

T1033System Owner/User Discovery

Command And Control · 2

T1071.001Web Protocols

Stealth · 3

T1027Obfuscated Files or Information T1036Masquerading

GIR coverage

7 / 480 requirements satisfied

Open matrix

1 · 1 - Malware

1.1.2

4 · 4 - Fraud, Identity Theft and Unauthorized Access

4.4.2

5 · 5 - Adversary Tactics and Activities

5.2.1 5.5.1

6 · 6 - Threats Impacting Industry or Region

6.1.6 6.2.2 6.2.5

Related actors

By origin and actor type

T1059.005

Visual Basic

T1204.001Malicious Link

T1547.001

Registry Run Keys / Startup Folder

T1057

Process Discovery

T1518Software Discovery

T1105

Ingress Tool Transfer

T1036.001

Invalid Code Signature