The White Company
The White Company is a nation-state APT group with an espionage motive, tracked by Brandefense. It targets 5 sectors, including Government and Finance, in 13 countries, including India and France. It uses 48 MITRE ATT&CK techniques and exploits 3 known CVEs.
Also known as
- G0089
- Operation “Shaheen”
- Techniques
- 48
- Exploited CVEs
- 3
- First seen
- Jan 1, 2016
- Last seen
- Jan 1, 2023
- Record updated
Who They Target.
How They Operate · MITRE ATT&CK.
48 techniques across 9 of 14 tacticsVulnerabilities They Exploit.
Browse Vulnerability Intelligence →CVE-2012-0158Microsoft MSCOMCTL.OCX contains an unspecified vulnerability that allows for remote code execution, allowing an attacker to take complete control of an affected system under the…ExploitedhighCVE-2015-1641Microsoft Office contains a memory corruption vulnerability due to failure to properly handle rich text format files in memory.ExploitedhighCVE-2016-7193Microsoft Office contains a memory corruption vulnerability which can allow for remote code execution.Exploitedhigh
Arsenal · Malware And Tools.
- NETWIREmalware
- Revenge RATmalware
About The White Company.
The White Company is a likely state-sponsored threat actor with advanced capabilities. From 2017 through 2018, the group led an espionage campaign called Operation Shaheen targeting government and military organizations in Pakistan.
Last updated Sep 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.