Bahamut is an elusive cyber espionage group that first came to public prominence in 2017, although its activities were noted as early as late 2016. Operating as a hack-for-hire entity, Bahamut does not align with a single national sponsor but offers its services to various clients, primarily conducting cyber espionage and disinformation campaigns. The group targets individuals and organizations across the Middle East and South Asia, focusing on intelligence gathering and data exfiltration. Bahamut distinguishes itself through its exceptional operational security, rapid infrastructure changes, and the meticulous creation of deceptive, often politically themed, websites, applications, and personas. This level of detail in social engineering, coupled with the frequent use of zero-day exploits and a preference for account takeovers over direct malware deployment, makes Bahamut a particularly challenging and patient adversary. The group is also known by the aliases Ehdevel, Windshift, Urpag

Aliases del actor

aunque no se han identificado sistemas específicos afectadosURPAGEEHDEVELWINDSHIFTThe White CompanyG0112InPage zero-dayMalicious MDMla defensa de infraestructuras críticasAPT BAHAMUT

Actores similares

apt-bahamutactor · 1apt-modifiedelephantactor · 1APT-C-36threat-actor · 1APT 28apt · 0APT 29apt · 0APT 41apt · 0APT-C-34apt · 0APT-C-27apt · 0APT-C-60apt · 0APT 5apt · 0