Threat Actor Characterization
Whitefly
ID: 288162a252c6cc8c6b3cafc2895ec2cc98093Actor Network Graph
Open Network GraphMITRE ATT&CK®
Whitefly (G0107) is a long-dwell espionage group active since at least 2017, linked publicly to the 2018 SingHealth breach in Singapore and known for disguised malicious executables, DLL search order hijacking (Vcrodat/Nibatad), credential theft (Mimikatz), and encrypted C2 payload staging.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1204.002 | Malicious File | TA0002 |
|
| T1574.001 | DLL | TA0003 TA0004 TA0005 |
|
| T1105 | Ingress Tool Transfer | TA0011 |
|
| T1003.001 | LSASS Memory | TA0006 |
|
| T1068 | Exploitation for Privilege Escalation | TA0004 |
|
| T1059 | Command and Scripting Interpreter | TA0002 |
|
CLASSIFICATION: Unclassified / Open Source
Executive Summary
Whitefly (MITRE G0107) is a cyber-espionage group active since at least 2017, assessed to target organizations mostly in Singapore across multiple sectors. Public reporting links Whitefly to the 2018 SingHealth breach (1.5M patient records), and describes consistent use of custom loaders (Vcrodat, Nibatad), DLL search order hijacking, malicious executables disguised as documents/images, and post-compromise credential theft (Mimikatz). The group mixes custom malware with open-source tools and living-off-the-land tradecraft to maintain long dwell times and exfiltrate large volumes of data. Overall confidence in the core profile is high based on MITRE and vendor primary reporting.
- Industries/Sectors: Healthcare; Media; Telecommunications; Engineering; (multinationals with Singapore presence also observed).
- Geography (Region): Primarily Southeast Asia.
- Countries (if available): Singapore (multiple incidents including the SingHealth breach).
- Timeframe: 2017–2019 (public reporting); MITRE page maintained through 2024.