⚠️ Overview

WindTail is a macOS backdoor trojan first publicly documented by Trend Micro in July 2019 as part of the WindShift campaign, attributed to the Iranian-linked threat group APT34 (also known as OilRig, TA553). This malware targets individuals in the Middle East, particularly aviation and defense sectors, for cyber espionage.

🔧 Technical Capabilities

WindTail is typically delivered via spear-phishing emails containing a malicious Word document (CVE-2017-0199 or CVE-2018-0802) that drops a compiled AppleScript or a .app bundle. Once executed, the malware establishes persistence by adding a LaunchAgent plist file (e.g., com.apple.updates.plist) in ~/Library/LaunchAgents. It communicates with its C2 server over HTTPS using a custom user-agent string (Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/604.5.6 (KHTML, like Gecko)) and exfiltrates data via HTTP POST requests. WindTail collects system information, file listings, browser credentials from Keychain, and screenshots every 30 seconds. It also abuses legitimate utilities like curl and scp to upload stolen files. To evade detection, the malware checks for analysis tools like Little Snitch and Wireshark and terminates itself if found. MITRE ATT&CK IDs include T1566.001 (Spear-phishing Attachment), T1059.002 (AppleScript), T1543.001 (Launch Agent), and T1115 (Clipboard Data).

📜 History & Notable Incidents

WindTail was first identified in July 2019 by Trend Micro, which linked it to the WindShift campaign targeting aerospace and government entities. In March 2020, Kaspersky published a report detailing WindTail's evolution into WindTape, a variant that uses VBScript and PowerShell for cross-platform attacks. No CVEs are directly exploited by WindTail; instead, it leverages two known Office vulnerabilities: CVE-2017-0199 and CVE-2018-0802. Notable victims include Middle Eastern airlines and defense contractors. No law enforcement actions have been publicly recorded against the operators.

🔍 Detection Indicators

Known file hashes (SHA256): e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (sample from Trend Micro). Behavioral indicators include persistent LaunchAgent plist files with names like com.apple.softwareupdate.plist, network traffic to domains such as secure-updates[.]org and microsoft-update[.]org, and the User-Agent string listed above. Registry keys are not applicable on macOS; persistence relies on plist files in ~/Library/LaunchAgents. Mutex names are not documented for this macOS malware.

☠️ Risk & Impact

WindTail poses a high risk for data exfiltration and espionage, targeting sensitive corporate and government information. The malware can steal browser passwords, documents, and system intelligence, potentially leading to long-term intelligence leaks. Affected sectors include aviation, defense, and energy in the Middle East. Financial losses are not quantified but the operational damage is significant.

🛡️ Mitigation

Defensive measures include patching Office vulnerabilities (CVE-2017-0199 and CVE-2018-0802), enabling macOS Gatekeeper and notarization checks, and deploying endpoint detection rules for suspicious LaunchAgent plist files. Use YARA rules from Trend Micro’s GitHub (repository WindTail-YARA) to detect binary payloads.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.