H3XA — Operational Evidence

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[The White Company](https://attack.mitre.org/groups/G0089) is a likely state-sponsored threat actor with advanced capabilities. From 2017 through 2018, the group led an espionage campaign called Operation Shaheen targeting government and military organizations in Pakistan.(Citation: Cylance Shaheen Nov 2018)

9 recorded

Relationships

uses

to Exploitation for Client Execution

Technique

uses

to File Deletion

Technique

uses

to Malicious File

Technique

uses

to NETWIRE

Malware

uses

to Revenge RAT

Malware

uses

to Security Software Discovery

Technique

uses

to Software Packing

Technique

uses

to Spearphishing Attachment

Technique

uses

to System Time Discovery

Technique

2 external

References

mitre-attack

G0089

open

Cylance Shaheen Nov 2018

https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/WhiteCompanyOperationShaheenReport.pdf?_ga=2.161661948.1943296560.1555683782-1066572390.1555511517

open