MITRE ATT&CKgroup
G0078 Gorgon Group
- Domain
- enterprise
- Version
- 1.5
- Created
- 2018-10-17
Description
Gorgon Group is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. The group has performed a mix of criminal and targeted attacks, including campaigns against government organizations in the United Kingdom, Spain, Russia, and the United States.
Related
Uses · MITRE ATT&CK (20)
- T1685 Disable or Modify Tools technique
- T1588.002 Tool sub-technique
- T1564.003 Hidden Window sub-technique
- T1204.002 Malicious File sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1059.005 Visual Basic sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1547.009 Shortcut Modification sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1055.002 Portable Executable Injection sub-technique
- T1055.012 Process Hollowing sub-technique
- S0385 njRAT software (malware)
- S0332 Remcos software (tool)
- S0336 NanoCore software (malware)
- S0262 QuasarRAT software (tool)
- T1140 Deobfuscate/Decode Files or Information technique
- T1105 Ingress Tool Transfer technique
- T1106 Native API technique
- T1112 Modify Registry technique
References
- https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/ Unit 42 Gorgon Group Aug 2018