{"type":"bundle","id":"bundle--e80e360e-9084-503f-ab17-d0b42e8084d9","objects":[{"type":"intrusion-set","id":"intrusion-set--0030ab1d-029e-50bd-9b3a-35c2fc7951a4","spec_version":"2.1","created":"2026-05-20T09:52:18.495523+00:00","modified":"2026-07-29T08:14:14.067+00:00","name":"Bahamut","description":"Bahamut is a sophisticated cyber-mercenary APT group active since at least 2016, operating across South Asia and the Middle East and offering espionage-for-hire services to a range of clients including suspected state sponsors. The group conducts targeted spear-phishing campaigns, deploys custom malware, and leverages fake applications and websites to compromise both Windows and mobile devices. Their targets span government entities, military personnel, journalists, activists, and private individuals, with operations driven by financial gain and the intelligence requirements of their paying clients.","aliases":["Urpage","Windshift","White Company","G0147"],"first_seen":"2016-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/bahamut"},{"source_name":"mitre-attack","external_id":"G0147","url":"https://attack.mitre.org/groups/G0147/"}],"labels":["hacktivist","esp"]},{"type":"attack-pattern","id":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e","spec_version":"2.1","created":"2026-05-20T09:52:18.495523+00:00","modified":"2026-07-29T08:14:14.067+00:00","name":"Windows Management Instrumentation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1047","url":"https://attack.mitre.org/techniques/T1047"}]},{"type":"relationship","id":"relationship--41493d47-2b6e-5109-8e6e-a54276784752","spec_version":"2.1","created":"2026-05-20T09:52:18.495523+00:00","modified":"2026-07-29T08:14:14.067+00:00","relationship_type":"uses","source_ref":"intrusion-set--0030ab1d-029e-50bd-9b3a-35c2fc7951a4","target_ref":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e"},{"type":"attack-pattern","id":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae","spec_version":"2.1","created":"2026-05-20T09:52:18.495523+00:00","modified":"2026-07-29T08:14:14.067+00:00","name":"System Owner/User Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1033","url":"https://attack.mitre.org/techniques/T1033"}]},{"type":"relationship","id":"relationship--dc3713ef-f14a-5584-a6f1-c1ab142a05bb","spec_version":"2.1","created":"2026-05-20T09:52:18.495523+00:00","modified":"2026-07-29T08:14:14.067+00:00","relationship_type":"uses","source_ref":"intrusion-set--0030ab1d-029e-50bd-9b3a-35c2fc7951a4","target_ref":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae"},{"type":"attack-pattern","id":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd","spec_version":"2.1","created":"2026-05-20T09:52:18.495523+00:00","modified":"2026-07-29T08:14:14.067+00:00","name":"Spearphishing Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.002","url":"https://attack.mitre.org/techniques/T1566/002"}]},{"type":"relationship","id":"relationship--2796b6e5-bb3e-53f5-931f-f9ab6bff54fd","spec_version":"2.1","created":"2026-05-20T09:52:18.495523+00:00","modified":"2026-07-29T08:14:14.067+00:00","relationship_type":"uses","source_ref":"intrusion-set--0030ab1d-029e-50bd-9b3a-35c2fc7951a4","target_ref":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd"},{"type":"attack-pattern","id":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed","spec_version":"2.1","created":"2026-05-20T09:52:18.495523+00:00","modified":"2026-07-29T08:14:14.067+00:00","name":"Spearphishing Attachment","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.001","url":"https://attack.mitre.org/techniques/T1566/001"}]},{"type":"relationship","id":"relationship--40912312-ad76-5ce6-a600-eca4a41adb15","spec_version":"2.1","created":"2026-05-20T09:52:18.495523+00:00","modified":"2026-07-29T08:14:14.067+00:00","relationship_type":"uses","source_ref":"intrusion-set--0030ab1d-029e-50bd-9b3a-35c2fc7951a4","target_ref":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed"},{"type":"attack-pattern","id":"attack-pattern--e52e2304-f280-5d73-9850-2a7a5b37727a","spec_version":"2.1","created":"2026-05-20T09:52:18.495523+00:00","modified":"2026-07-29T08:14:14.067+00:00","name":"Masquerading","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036","url":"https://attack.mitre.org/techniques/T1036"}]},{"type":"relationship","id":"relationship--c3854acd-c2c1-52a1-b7b2-cb9cc1dc6922","spec_version":"2.1","created":"2026-05-20T09:52:18.495523+00:00","modified":"2026-07-29T08:14:14.067+00:00","relationship_type":"uses","source_ref":"intrusion-set--0030ab1d-029e-50bd-9b3a-35c2fc7951a4","target_ref":"attack-pattern--e52e2304-f280-5d73-9850-2a7a5b37727a"},{"type":"attack-pattern","id":"attack-pattern--512d8208-66a2-5f60-8683-ce6555aa98fd","spec_version":"2.1","created":"2026-05-20T09:52:18.495523+00:00","modified":"2026-07-29T08:14:14.067+00:00","name":"Drive-by Compromise","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1189","url":"https://attack.mitre.org/techniques/T1189"}]},{"type":"relationship","id":"relationship--542afe6a-c8be-56ef-89dc-0bd23302f3a2","spec_version":"2.1","created":"2026-05-20T09:52:18.495523+00:00","modified":"2026-07-29T08:14:14.067+00:00","relationship_type":"uses","source_ref":"intrusion-set--0030ab1d-029e-50bd-9b3a-35c2fc7951a4","target_ref":"attack-pattern--512d8208-66a2-5f60-8683-ce6555aa98fd"},{"type":"attack-pattern","id":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e","spec_version":"2.1","created":"2026-05-20T09:52:18.495523+00:00","modified":"2026-07-29T08:14:14.067+00:00","name":"Visual Basic","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.005","url":"https://attack.mitre.org/techniques/T1059/005"}]},{"type":"relationship","id":"relationship--f8ddf9d9-352f-5cd0-a755-d6b494b8483b","spec_version":"2.1","created":"2026-05-20T09:52:18.495523+00:00","modified":"2026-07-29T08:14:14.067+00:00","relationship_type":"uses","source_ref":"intrusion-set--0030ab1d-029e-50bd-9b3a-35c2fc7951a4","target_ref":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e"},{"type":"attack-pattern","id":"attack-pattern--6bc23961-1631-5f3d-8eac-6d2d27bed39d","spec_version":"2.1","created":"2026-05-20T09:52:18.495523+00:00","modified":"2026-07-29T08:14:14.067+00:00","name":"Software Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1518","url":"https://attack.mitre.org/techniques/T1518"}]},{"type":"relationship","id":"relationship--b61ddb9f-0569-5f7f-ac18-dc022be229b3","spec_version":"2.1","created":"2026-05-20T09:52:18.495523+00:00","modified":"2026-07-29T08:14:14.067+00:00","relationship_type":"uses","source_ref":"intrusion-set--0030ab1d-029e-50bd-9b3a-35c2fc7951a4","target_ref":"attack-pattern--6bc23961-1631-5f3d-8eac-6d2d27bed39d"},{"type":"attack-pattern","id":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4","spec_version":"2.1","created":"2026-05-20T09:52:18.495523+00:00","modified":"2026-07-29T08:14:14.067+00:00","name":"Registry Run Keys / Startup Folder","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547.001","url":"https://attack.mitre.org/techniques/T1547/001"}]},{"type":"relationship","id":"relationship--7ab00f64-b17b-541d-ae4a-aa47b8f96276","spec_version":"2.1","created":"2026-05-20T09:52:18.495523+00:00","modified":"2026-07-29T08:14:14.067+00:00","relationship_type":"uses","source_ref":"intrusion-set--0030ab1d-029e-50bd-9b3a-35c2fc7951a4","target_ref":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4"},{"type":"attack-pattern","id":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc","spec_version":"2.1","created":"2026-05-20T09:52:18.495523+00:00","modified":"2026-07-29T08:14:14.067+00:00","name":"Malicious Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1204.001","url":"https://attack.mitre.org/techniques/T1204/001"}]},{"type":"relationship","id":"relationship--c1b3f8a3-d59a-5e0c-9f4d-f2378c3b7778","spec_version":"2.1","created":"2026-05-20T09:52:18.495523+00:00","modified":"2026-07-29T08:14:14.067+00:00","relationship_type":"uses","source_ref":"intrusion-set--0030ab1d-029e-50bd-9b3a-35c2fc7951a4","target_ref":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc"},{"type":"attack-pattern","id":"attack-pattern--83bf6bd6-5ec5-5d2a-9ded-a83895020e8f","spec_version":"2.1","created":"2026-05-20T09:52:18.495523+00:00","modified":"2026-07-29T08:14:14.067+00:00","name":"Obfuscated Files or Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027","url":"https://attack.mitre.org/techniques/T1027"}]},{"type":"relationship","id":"relationship--7619b64f-c5da-5f85-91fb-37111b779848","spec_version":"2.1","created":"2026-05-20T09:52:18.495523+00:00","modified":"2026-07-29T08:14:14.067+00:00","relationship_type":"uses","source_ref":"intrusion-set--0030ab1d-029e-50bd-9b3a-35c2fc7951a4","target_ref":"attack-pattern--83bf6bd6-5ec5-5d2a-9ded-a83895020e8f"},{"type":"attack-pattern","id":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9","spec_version":"2.1","created":"2026-05-20T09:52:18.495523+00:00","modified":"2026-07-29T08:14:14.067+00:00","name":"Web Protocols","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.001","url":"https://attack.mitre.org/techniques/T1071/001"}]},{"type":"relationship","id":"relationship--dd6f6ce0-45e7-538c-bd7c-f5169e4fddb9","spec_version":"2.1","created":"2026-05-20T09:52:18.495523+00:00","modified":"2026-07-29T08:14:14.067+00:00","relationship_type":"uses","source_ref":"intrusion-set--0030ab1d-029e-50bd-9b3a-35c2fc7951a4","target_ref":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9"},{"type":"attack-pattern","id":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4","spec_version":"2.1","created":"2026-05-20T09:52:18.495523+00:00","modified":"2026-07-29T08:14:14.067+00:00","name":"Process Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1057","url":"https://attack.mitre.org/techniques/T1057"}]},{"type":"relationship","id":"relationship--b9c6a4ec-6a7a-5377-b5a1-2183f42ece5e","spec_version":"2.1","created":"2026-05-20T09:52:18.495523+00:00","modified":"2026-07-29T08:14:14.067+00:00","relationship_type":"uses","source_ref":"intrusion-set--0030ab1d-029e-50bd-9b3a-35c2fc7951a4","target_ref":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4"},{"type":"attack-pattern","id":"attack-pattern--901e3ee7-fbb7-5030-8ed3-f2a219a543ba","spec_version":"2.1","created":"2026-05-20T09:52:18.495523+00:00","modified":"2026-07-29T08:14:14.067+00:00","name":"Invalid Code Signature","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.001","url":"https://attack.mitre.org/techniques/T1036/001"}]},{"type":"relationship","id":"relationship--9af9b536-86c0-5ba7-936b-9a62e9a3299c","spec_version":"2.1","created":"2026-05-20T09:52:18.495523+00:00","modified":"2026-07-29T08:14:14.067+00:00","relationship_type":"uses","source_ref":"intrusion-set--0030ab1d-029e-50bd-9b3a-35c2fc7951a4","target_ref":"attack-pattern--901e3ee7-fbb7-5030-8ed3-f2a219a543ba"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-20T09:52:18.495523+00:00","modified":"2026-07-29T08:14:14.067+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--4987b9a5-578f-5251-8d6f-77f5d405560d","spec_version":"2.1","created":"2026-05-20T09:52:18.495523+00:00","modified":"2026-07-29T08:14:14.067+00:00","relationship_type":"uses","source_ref":"intrusion-set--0030ab1d-029e-50bd-9b3a-35c2fc7951a4","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"attack-pattern","id":"attack-pattern--9eb184f4-55af-53a7-97c4-5f226ca51dd7","spec_version":"2.1","created":"2026-05-20T09:52:18.495523+00:00","modified":"2026-07-29T08:14:14.067+00:00","name":"Spearphishing via Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.003","url":"https://attack.mitre.org/techniques/T1566/003"}]},{"type":"relationship","id":"relationship--f7c2ea32-f69e-5c1b-8429-f95b2f648128","spec_version":"2.1","created":"2026-05-20T09:52:18.495523+00:00","modified":"2026-07-29T08:14:14.067+00:00","relationship_type":"uses","source_ref":"intrusion-set--0030ab1d-029e-50bd-9b3a-35c2fc7951a4","target_ref":"attack-pattern--9eb184f4-55af-53a7-97c4-5f226ca51dd7"}]}