Cyber Threat Actor: White Company

The threat actor known as White Company, also referenced by its alias, is a nation‑state group whose known location is China. It has been observed conducting espionage operations that focus on military and national‑security targets, most notably the Pakistan Air Force, which is tied to the country’s nuclear weapons programme and its newly announced National Centre for Cyber Security. The actor’s strategic objective in the observed campaign was the collection of tactical and strategic intelligence from a high‑value target linked to national security. The group’s activity is described as state‑sponsored, indicating backing from a governmental entity, although the specific sponsor has not been publicly confirmed. White Company’s targeting appears limited to sectors that provide strategic insight, with no public indication of financially motivated or disruptive intent. The actor’s operations are characterized by a deliberate effort to obscure its origins and evade attribution through the use of varied tooling and obfuscation techniques.

In its publicly reported Operation Shaheen campaign, White Company delivered spear‑phishing emails that contained weaponized lure files referencing government affairs, Chinese military activities and topics relevant to the Pakistan Air Force. Initial access was achieved either through links to compromised websites or via malicious Word document attachments that deployed multi‑layered malware. The malware employed five different packing techniques to conceal its payload and was capable of evading detection by major antivirus products such as Sophos, ESET, Kaspersky, BitDefender, Avira, Avast, AVG and Quickheal. The group’s tooling style involves assembling utilities created by several different developers, some of whom have taken steps to cover their tracks, which contributes to the difficulty of attribution. While the actor is identified as a nation‑state entity, the extensive obfuscation and use of diversified tooling have prevented a definitive public attribution to any particular state, despite the contextual note that the group’s location is China. The campaign was described as a year‑long espionage effort directed at the Pakistani Air Force, highlighting the actor’s persistence and focus on sustained intelligence gathering.