apt

Bahamut

activeAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

APT / State-sponsored

WindshiftBahamutAPT-C-58

Attribution

Cyber-mercenary / hack-for-hire espionage group; sponsor unconfirmed. MITRE consolidates Bahamut and Windshift under one entry (G0112); some vendors treat them as distinct but related clusters.

Origin

Unknown

First seen

2017

Last active

2024

Motivation

Espionage

Attribution confidence

medium

MENA targeting

Egypt, Iran, Palestine, Turkey, Tunisia, Saudi Arabia, Qatar, UAE

Sectors

Government officials, diplomats, human rights NGOs, activists

MITRE ATT&CK

G0112 ↗

Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Egypt, Iran, Palestine (Government officials, diplomats, human rights NGOs sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

SideWinderactorTechnique overlap
Gaza Cybergang / MoleratsactorTechnique overlap
Earth BogleactorTechnique overlap
MuddyWateractorTechnique overlap
Tropic TrooperactorTechnique overlap
WIRTEactorTechnique overlap
Infy / Prince of PersiaactorTechnique overlap
APT33actorTechnique overlap
Dust Specter

Coverage robustness · vs this actor

How evasion-resistant our detection coverage is against Bahamut's techniques — Summiting the Pyramid scores analytics (1 brittle – 5 robust); the actor inherits through its TTPs. This is a detection-engineering metric, not an attribution signal — see Attribution for confidence.

Techniques with a robust rule

Techniques with any detection

13 / 25

Mean robustness (of covered)

Useful?

OilRig (APT34)actorTechnique overlap

Imperial Kitten (CURIUM)actorTechnique overlap

Dark CaracalactorTechnique overlap

HEXANE (Lyceum)actorTechnique overlap

Stealth FalconactorTechnique overlap

Charming Kitten / APT42actorTechnique overlap

APT39 / ChaferactorTechnique overlap

Qilin (fka Agenda)actorTechnique overlap

Cl0pactorTechnique overlap

Rocket KittenactorTechnique overlap

Flying KittenactorTechnique overlap

Group5actorTechnique overlap

Void Manticore (Storm-0842)actorTechnique overlap

UNC1549 / TA455actorTechnique overlap

Cavern ManticoreactorTechnique overlap

Scarred Manticore (Storm-0861)actorTechnique overlap

Ballistic BobcatactorTechnique overlap

Storm-1133actorTechnique overlap

Careto / MaskactorTechnique overlap

StrongPity (PROMETHIUM)actorTechnique overlap

Syrian Electronic ArmyactorTechnique overlap

Sea TurtleactorTechnique overlap

ALPHV / BlackCatactorTechnique overlap

RansomHubactorTechnique overlap

MedusaactorTechnique overlap

LockBit / LockBit 3.0actorTechnique overlap

Uses

Hide InfrastructuretechniqueATT&CK mapping
Visual BasictechniqueATT&CK mapping
System Owner/User DiscoverytechniqueATT&CK mapping

+22 more relationships — see the relationships browser.