Introduction
Gorgon Group is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. The group has performed a mix of criminal and targeted attacks, including campaigns against government organizations in the United Kingdom, Spain, Russia, and the United States. Unit 42 Gorgon Group Aug 2018
Activities and Tactics
Information pending cataloguing.
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
- T1055.012 Process Hollowing
- T1685 Disable or Modify Tools
- T1140 Deobfuscate/Decode Files or Information
- T1106 Native API
- T1547.001 Registry Run Keys / Startup Folder
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1105 Ingress Tool Transfer
- T1566.001 Spearphishing Attachment
- T1564.003 Hidden Window
- T1055.002 Portable Executable Injection
- T1112 Modify Registry
- T1547.009 Shortcut Modification
- T1204.002 Malicious File
- T1588.002 Tool
- T1059.005 Visual Basic
ATT&CK technique IDs (denormalized)
- T1055.002
- T1055.012
- T1059.001
- T1059.003
- T1059.005
- T1105
- T1106
- T1112
- T1140
- T1204.002
- T1547.001
- T1547.009
- T1564.003
- T1566.001
- T1588.002
- T1685
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
MITRE ATT&CK Software
Attribution and Evidence
Information pending cataloguing.
References
[1] mitre-attack [3] Unit 42 Gorgon Group Aug 2018 Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.