WindShift__2019__analyzing_WindShift_implant_OSX.WindTail.pdf
ID: 3858f5bf-ea13-4e32-8a2c-6e8072c73b62
STIX ID: report--3858f5bf-ea13-4e32-8a2c-6e8072c73b62
Threat Score
72/100
Uploaded: 2026-08-19
Published Date: 2019-03-05
Last Modified Date: 2019-03-05
Created by: dogesec
TLP:CLEAR
ADMIRALTY:B2
PAP:CLEAR
...
...
This report analyzes WindShift's macOS implant OSX.WindTail, describing its infection vectors, persistence via login items, encryption keys used to decrypt payloads, and potential C2 communications, while linking multiple samples to the WindShift APT and discussing limited AV detections and recommended defense steps.