Gorgon Group G0078

Overview 48 indicators

Gorgon Group is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. The group has performed a mix of criminal and targeted attacks, including campaigns against government organizations in the United Kingdom, Spain, Russia, and the United States.

Techniques 16 ATT&CK

Open in ATT&CK Navigator → or download the layer (16 techniques, layer 4.5)

• T1055.002 Portable Executable Injection
• T1055.012 Process Hollowing
• T1059.001 PowerShell
• T1059.003 Windows Command Shell
• T1059.005 Visual Basic
• T1105 Ingress Tool Transfer
• T1106 Native API
• T1112 Modify Registry
• T1140 Deobfuscate/Decode Files or Information
• T1204.002 Malicious File
• T1547.001 Registry Run Keys / Startup Folder
• T1547.009 Shortcut Modification
• T1564.003 Hidden Window
• T1566.001 Spearphishing Attachment
• T1588.002 Tool
• T1685 Disable or Modify Tools

Software 4

• QuasarRAT
• Remcos
• NanoCore
• njRAT

Principal sources 18 reports

Ranked by how many of this actor's indicators each report brought in.

• 18github.com/pan-unit42/iocs/blob/master/gorgon/doma…
• 18virustotal.com/gui/file/24adef104d6f177525f24c927e764c…
• 14github.com/StrangerealIntel/CyberThreatIntel/blob/…
• 14otx.alienvault.com/pulse/5d68fb8d77464e86898969f5
• 5unit42.paloaltonetworks.com/aggah-campaign-bit-ly-blogspot-and-past…
• 2virustotal.com/gui/file/ec76393c14e8014ec4ffb659769939…
• 2seqrite.com/blog/gorgon-apt-targeting-msme-sector-i…
• 2otx.alienvault.com/pulse/5f34028dcae5e941a198b11d

Related groups 4

What the sources have in common — not a claim that these are the same actor. See the whole graph.

• APT-C-36 G0099
  shares Remcos, njRAT, QuasarRAT
• LazyScripter G0140
  shares Remcos, njRAT, QuasarRAT
• Group5 G0043
  shares NanoCore, njRAT
• APT33 G0064
  shares NanoCore

Timeline 48 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.

1. 2022-06-07 1 url4 yrs ago

   github.com/pan-unit42/iocs/blob/master/gorgon/doma… · virustotal.com/gui/file/24adef104d6f177525f24c927e764c…

   t2m.io/GbiSgY

   copy batch

2. 2021-12-28 1 domain5 yrs ago

   virustotal.com/gui/file/6cb398873ff8759283d8aecc2077ba…

   downloads.blogsyte.com

   copy batch

3. 2020-08-18 1 domain, 1 ipv46 yrs ago

   virustotal.com/gui/file/ec76393c14e8014ec4ffb659769939…

   domain	x-ghost91.ddns.net
   ipv4	196.185.215.228:81

   copy batch

4. 2020-08-12 2 url6 yrs ago

   seqrite.com/blog/gorgon-apt-targeting-msme-sector-i… · otx.alienvault.com/pulse/5f34028dcae5e941a198b11d

   m9c.net/uploads/15882060891.jpg

   m9c.net/uploads/15882060892.jpg

   copy batch

5. 2020-06-15 1 domain6 yrs ago

   twitter.com/Arkbird_SOLG/status/1272512736795283456

   dixis.bounceme.net

   copy batch

6. 2020-02-11 1 domain6 yrs ago

   twitter.com/Zhx_8885/status/1227219569095262208 · virustotal.com/gui/domain/gritodopovo.com.br/relations

   gritodopovo.com.br

   copy batch

7. 2019-10-27 5 domain7 yrs ago

   unit42.paloaltonetworks.com/aggah-campaign-bit-ly-blogspot-and-past…

   bjm9.blogspot.com

   buydildoonline.blogspot.com

   emawattttson.blogspot.com

   miganshumarataa.blogspot.com

   treffictesgn.blogspot.com

   copy batch

8. 2019-10-27 1 domain7 yrs ago

   twitter.com/MisterCh0c/status/1188219763660591107 · app.any.run/tasks/c32b295c-08f4-4337-8f7f-378ba7f9e…

   asdiamecwecw8cew.blogspot.com

   copy batch

9. 2019-09-10 1 domain7 yrs ago

   twitter.com/Rmy_Reserve/status/1171381881461338112 · app.any.run/tasks/bb1279af-7fff-4b37-8439-7b303f113…

   sxasxasxssaxxsasxasx.blogspot.com

   copy batch

10. 2019-08-31 14 domain7 yrs ago

    github.com/StrangerealIntel/CyberThreatIntel/blob/… · otx.alienvault.com/pulse/5d68fb8d77464e86898969f5

    1688jtn.com

    41230077.net

    6474sss.com

    grupomsi.com

    hongmenwenhua.com

    ichoubyou.net

    klapki.online

    qp0o1j3-dmv4kwncw8e.win

    sukfat.com

    theaterloops.com

    thedip.zone

    tourismmanagement.mba

    xaasxasxasx.blogspot.com

    ycsfuoabdicating.review

    copy batch

11. 2019-06-29 17 domain7 yrs ago

    github.com/pan-unit42/iocs/blob/master/gorgon/doma… · virustotal.com/gui/file/24adef104d6f177525f24c927e764c…

    0-day.us

    acorn-paper.com

    asaigoldenrice.com

    brevini-france.cf

    diamondfoxpanel.ml

    fast-cargo.com

    guelphupholstery.com

    ocha-gidi.xyz

    onedrivenet.xyz

    panelonetwothree.ga

    panelonetwothree.ml

    securebotnetpanel.tk

    stemtopx.com

    stevemike-fireforce.info

    stevemikeforce.com

    xyz-storez.xyz

    zupaservices.info

    copy batch

12. 2019-06-19 2 domain7 yrs ago

    twitter.com/h4ckak/status/1145984273985331200 · otx.alienvault.com/pulse/5d1b49a55c01f486b6ff8cf2

    bylgay.hopto.org

    microsoftoutlook.duckdns.org

    copy batch

Further reading 20

• attack.mitre.org/groups/G0078
• researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-…
• app.any.run/tasks/c32b295c-08f4-4337-8f7f-378ba7f9e…
• otx.alienvault.com/pulse/5d68fb8d77464e86898969f5
• twitter.com/MisterCh0c/status/1188219763660591107
• twitter.com/Arkbird_SOLG/status/1272512736795283456
• app.any.run/tasks/bb1279af-7fff-4b37-8439-7b303f113…
• unit42.paloaltonetworks.com/aggah-campaign-bit-ly-blogspot-and-past…
• github.com/pan-unit42/iocs/blob/master/gorgon/doma…
• virustotal.com/gui/file/6cb398873ff8759283d8aecc2077ba…
• twitter.com/Rmy_Reserve/status/1171381881461338112
• twitter.com/Zhx_8885/status/1227219569095262208
• github.com/StrangerealIntel/CyberThreatIntel/blob/…
• seqrite.com/blog/gorgon-apt-targeting-msme-sector-i…
• otx.alienvault.com/pulse/5f34028dcae5e941a198b11d
• twitter.com/h4ckak/status/1145984273985331200
• virustotal.com/gui/file/ec76393c14e8014ec4ffb659769939…
• virustotal.com/gui/file/24adef104d6f177525f24c927e764c…
• otx.alienvault.com/pulse/5d1b49a55c01f486b6ff8cf2
• virustotal.com/gui/domain/gritodopovo.com.br/relations