Whitefly is a cyber espionage group that has been operating since at least 2017. The group has targeted organizations based mostly in Singapore across a wide variety of sectors, and is primarily interested in stealing large amounts of sensitive information. The group has been linked to an attack against Singapore’s largest public health organization, SingHealth.[1]
9
Techniques30th pct
6
Tactics34th pct
1
Tool or malwareBottom 23%
0
CampaignsNone recorded
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
Whitefly has the ability to download additional tools from the C2.7
Command and Control131 detection rules
Standing G0107
Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques930th pct
30th percentile · 70% of 176 ATT&CK groups have more Enterprise techniques.
Tactics634th pct
34th percentile · 66% of 176 ATT&CK groups have more tactics spanned.
Tool or malware1Bottom 23%
23rd percentile · 77% of 176 ATT&CK groups have more tools and malware.
Campaigns089% tie · 4 values
89% of the population shares a single value across only 4 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique88medTop 1%
99th percentile · 99% of 176 ATT&CK groups have this many detection rules per technique or fewer.
Tests / technique4med
Whitefly detections G0107
658 distinct rules cover the 9 techniques recorded for this group. 461 Sigma · 197 Splunk.
9 covered by at least one rule658 distinct rules in total
Showing 1-50 of 600+ rules
Drag headers to reorder | Drag edges to resize
Select
Title
Description
Category
Status
Event
OS
Product
MITRE ATT&CK
CVEs
Severity
Author
Created
Updated
ID
Refs
Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.
The following analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, privilege escalation, password dumping or data exfiltration. (...)
Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...)
Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.
The following analytic detects the creation of a batch file (.bat) within the Windows system directory tree, specifically in the System32 or SysWOW64 folders. (...)
This analytic detects suspicious python package installations where the package name resembles popular Python libraries but may be typosquatted or slightly altered. (...)
This analytic detects unexpected outbound network connections initiated by known webserver processes such as `httpd.exe`, `nginx.exe`, or `tomcat.exe` to common file sharing or public content hosting services like GitHub, Discord CDN, Transfer.sh, or Pastebin. (...)
The following analytic detects file downloads involving executable, archive, or scripting-related file types that are commonly used in malware delivery. (...)
Michael Haag, Nasreddine Bencherchali, Splunk, Talos NTDR
2025-07-17
2026-05-13
93db24a0-fd21-45d7-9daf-84afd5a8cca2
Splunk
The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. (...)
The following analytic detects connections with a high Encrypted Visibility Engine (EVE) threat confidence score, indicating potentially malicious behavior within encrypted traffic. (...)
This analytic detects HTTP requests to privileged execution paths on Cisco routers, specifically targeting the `/level/15/exec/-/*` endpoint using Cisco Secure Firewall Intrusion Events. (...)