Group5 G0043

Overview 4 indicators

Group5 is a threat group with a suspected Iranian nexus, though this attribution is not definite. The group has targeted individuals connected to the Syrian opposition via spearphishing and watering holes, normally using Syrian and Iranian themes. Group5 has used two commonly available remote access tools (RATs), njRAT and NanoCore, as well as an Android RAT, DroidJack.

Techniques 4 ATT&CK

Open in ATT&CK Navigator → or download the layer (4 techniques, layer 4.5)

• T1027.013 Encrypted/Encoded File
• T1056.001 Keylogging
• T1070.004 File Deletion
• T1113 Screen Capture

Software 2

• NanoCore
• njRAT

Principal sources 1 reports

Ranked by how many of this actor's indicators each report brought in.

• 4citizenlab.ca/2016/08/group5-syria

Related groups 2

What the sources have in common — not a claim that these are the same actor. See the whole graph.

• Gorgon Group G0078
  shares NanoCore, njRAT
• APT33 G0064
  shares NanoCore

Timeline 4 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.

1. 2018-09-22 4 domain8 yrs ago

   citizenlab.ca/2016/08/group5-syria

   assadcrimes.info

   crypter.ir

   crypting.org

   server22.rayanegarco.com

   copy batch

Further reading 2

• attack.mitre.org/groups/G0043
• citizenlab.ca/2016/08/group5-syria