FORENSIA

THREAT_ACTOR · G0107

Whitefly

Also known as: Whitefly

Profile

Whitefly is a cyber espionage group that has been operating since at least 2017. The group has targeted organizations based mostly in Singapore across a wide variety of sectors, and is primarily interested in stealing large amounts of sensitive information. The group has been linked to an attack against Singapore’s largest public health organization, SingHealth.

MITRE ATT&CK ↗

Techniques

9 ATT&CK techniques attributed to this actor.

T1003.001 LSASS MemoryT1027.013 Encrypted/Encoded FileT1036.005 Match Legitimate Resource Name or LocationT1059 Command and Scripting InterpreterT1068 Exploitation for Privilege EscalationT1105 Ingress Tool TransferT1204.002 Malicious FileT1574.001 DLLT1588.002 Tool

Software

1 malware/tools attributed to this actor.

Mimikatz

Related corpus activity

9,202 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to Whitefly.

IndicatorTypeFamilySevSrc
cve-2026-0740cve—851
cve-2026-3844cve—851
cve-2025-68670cve—852
cve-2026-1969cve—851
cve-2025-7852cve—851
cve-2022-47945cve—851
cve-2026-22584cve—852
cve-2025-11837cve—852
cve-2018-8007cve—851
cve-2021-29441cve—851
cve-2025-12057cve—851
cve-2025-7443cve—851
cve-2017-17215cve—852
cve-2025-34085cve—851
cve-2025-66478cve—852
cve-2025-0921cve—852
cve-2021-27076cve—851
cve-2013-3307cve—852
cve-2016-5681cve—852
cve-2024-1781cve—851
cve-2026-3102cve—853
cve-2026-4368cveransomware851
cve-2025-23304cve—852
123e80a34508c4dede7cc70e76931fcchash—803
7105caa6d4fd8a2c67523d385277528e556ae4f6hash—802
9c44bc9373377831c45dd0ac2661a28ehash—803
44a4ac119349f525d877728b53fe38453a516881d577679caf08ab69312a695fsha256phishing802
82e579bd49d69845133c9aa8585f8bd26736437bhash—802
d35695f2366a43628231e73ffa83ca106306a8fahash—802
03b51af0a04467cebfa235199db4c02ehashwallet_compromise801

Showing the top 30 by severity of 9,202.