{
  "id": "the-white-company",
  "name": "The White Company",
  "aliases": [],
  "domain": "cyber",
  "country": "UNK",
  "category": "Suspected state-linked cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [],
  "summary": "The White Company is a likely state-sponsored threat actor with advanced capabilities. From 2017 through 2018, the group led an espionage campaign called Operation Shaheen targeting government and military organizations in Pakistan.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Likely state-sponsored (sponsor not named)",
      "src": [
        "mitre-g0089"
      ],
      "conf": "medium"
    },
    {
      "k": "attack_id",
      "v": "G0089",
      "src": [
        "mitre-g0089"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "From 2017 through 2018, the group led an espionage campaign called Operation Shaheen targeting government and military organizations in Pakistan.",
      "src": [
        "mitre-g0089"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 7,
      "src": [
        "mitre-g0089"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "NETWIRE, Revenge RAT",
      "src": [
        "mitre-g0089"
      ],
      "conf": "high",
      "note": "2 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "The White Company is a likely state-sponsored threat actor with advanced capabilities. From 2017 through 2018, the group led an espionage campaign called Operation Shaheen targeting government and military organizations in Pakistan. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0089)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/the-white-company.html",
  "sources": {
    "mitre-g0089": {
      "title": "The White Company, Group G0089",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0089/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}