{
	"id": "f00bddf7-dd67-4ad8-ac00-a26a7b881d12",
	"created_at": "2026-04-06T01:29:59.244311Z",
	"updated_at": "2026-04-10T13:11:21.576419Z",
	"deleted_at": null,
	"sha1_hash": "e8edf1c7f0f6164f9fce2b863de62b7d7e13d924",
	"title": "The White Company - Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 46859,
	"plain_text": "The White Company - Threat Group Cards: A Threat Actor\nEncyclopedia\nArchived: 2026-04-06 00:18:01 UTC\nHome \u003e List all groups \u003e The White Company\n APT group: The White Company\nNames\nThe White Company (Cylance)\nG0089 (MITRE)\nCountry [Unknown]\nSponsor State-sponsored\nMotivation Information theft and espionage\nFirst seen 2017\nDescription\n(Cylance) Cylance has determined that Operation Shaheen was an espionage\ncampaign executed over the course of the last year. It was a targeted campaign which\nappeared to focus on individuals and organizations in Pakistan, specifically the\ngovernment and the military. Cylance’s window into this campaign, though\nsignificant, is not all-encompassing. Indeed, our research revealed evidence that The\nWhite Company conducted extensive prior reconnaissance of its targets, and\ncontinues to operate largely unnoticed by the security community.\nObserved\nSectors: Defense, Government.\nCountries: Pakistan.\nTools used\nOperations performed Nov 2017\nOperation “Shaheen”\nWe have dubbed the first campaign Operation Shaheen. It\nexamines a complex espionage effort directed at the Pakistani\nmilitary.\nInformation\nMITRE ATT\u0026CK Last change to this card: 16 August 2025\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=7f575804-406b-4dde-b2ce-563eca80c703\nPage 1 of 2\n\nDownload this actor card in PDF or JSON format\r\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=7f575804-406b-4dde-b2ce-563eca80c703\r\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=7f575804-406b-4dde-b2ce-563eca80c703\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=7f575804-406b-4dde-b2ce-563eca80c703"
	],
	"report_names": [
		"showcard.cgi?u=7f575804-406b-4dde-b2ce-563eca80c703"
	],
	"threat_actors": [
		{
			"id": "0451922a-d2c6-4917-a2fd-3f3b3547d697",
			"created_at": "2022-10-25T16:07:24.391313Z",
			"updated_at": "2026-04-10T02:00:04.972764Z",
			"deleted_at": null,
			"main_name": "The White Company",
			"aliases": [
				"G0089",
				"Operation Shaheen"
			],
			"source_name": "ETDA:The White Company",
			"tools": [],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "9962552c-9d9d-4627-97f6-4558183fdd7f",
			"created_at": "2022-10-25T15:50:23.448869Z",
			"updated_at": "2026-04-10T02:00:05.390938Z",
			"deleted_at": null,
			"main_name": "The White Company",
			"aliases": [
				"The White Company"
			],
			"source_name": "MITRE:The White Company",
			"tools": [
				"Revenge RAT",
				"NETWIRE"
			],
			"source_id": "MITRE",
			"reports": null
		}
	],
	"ts_created_at": 1775438999,
	"ts_updated_at": 1775826681,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/e8edf1c7f0f6164f9fce2b863de62b7d7e13d924.pdf",
		"text": "https://archive.orkl.eu/e8edf1c7f0f6164f9fce2b863de62b7d7e13d924.txt",
		"img": "https://archive.orkl.eu/e8edf1c7f0f6164f9fce2b863de62b7d7e13d924.jpg"
	}
}