{
  "aliases": [],
  "attack_id": "G0078",
  "attack_name": "Gorgon Group",
  "attack_url": "https://attack.mitre.org/groups/G0078/",
  "counts": {
    "domain": 44,
    "ipv4": 1,
    "url": 3
  },
  "first_seen": {
    "domain": {
      "0-day.us": "2019-06-29",
      "1688jtn.com": "2019-08-31",
      "41230077.net": "2019-08-31",
      "6474sss.com": "2019-08-31",
      "acorn-paper.com": "2019-06-29",
      "asaigoldenrice.com": "2019-06-29",
      "asdiamecwecw8cew.blogspot.com": "2019-10-27",
      "bjm9.blogspot.com": "2019-10-27",
      "brevini-france.cf": "2019-06-29",
      "buydildoonline.blogspot.com": "2019-10-27",
      "bylgay.hopto.org": "2019-06-19",
      "diamondfoxpanel.ml": "2019-06-29",
      "dixis.bounceme.net": "2020-06-15",
      "downloads.blogsyte.com": "2021-12-28",
      "emawattttson.blogspot.com": "2019-10-27",
      "fast-cargo.com": "2019-06-29",
      "gritodopovo.com.br": "2020-02-11",
      "grupomsi.com": "2019-08-31",
      "guelphupholstery.com": "2019-06-29",
      "hongmenwenhua.com": "2019-08-31",
      "ichoubyou.net": "2019-08-31",
      "klapki.online": "2019-08-31",
      "microsoftoutlook.duckdns.org": "2019-06-19",
      "miganshumarataa.blogspot.com": "2019-10-27",
      "ocha-gidi.xyz": "2019-06-29",
      "onedrivenet.xyz": "2019-06-29",
      "panelonetwothree.ga": "2019-06-29",
      "panelonetwothree.ml": "2019-06-29",
      "qp0o1j3-dmv4kwncw8e.win": "2019-08-31",
      "securebotnetpanel.tk": "2019-06-29",
      "stemtopx.com": "2019-06-29",
      "stevemike-fireforce.info": "2019-06-29",
      "stevemikeforce.com": "2019-06-29",
      "sukfat.com": "2019-08-31",
      "sxasxasxssaxxsasxasx.blogspot.com": "2019-09-10",
      "theaterloops.com": "2019-08-31",
      "thedip.zone": "2019-08-31",
      "tourismmanagement.mba": "2019-08-31",
      "treffictesgn.blogspot.com": "2019-10-27",
      "x-ghost91.ddns.net": "2020-08-18",
      "xaasxasxasx.blogspot.com": "2019-08-31",
      "xyz-storez.xyz": "2019-06-29",
      "ycsfuoabdicating.review": "2019-08-31",
      "zupaservices.info": "2019-06-29"
    },
    "ipv4": {
      "196.185.215.228:81": "2020-08-18"
    },
    "url": {
      "m9c.net/uploads/15882060891.jpg": "2020-08-12",
      "m9c.net/uploads/15882060892.jpg": "2020-08-12",
      "t2m.io/GbiSgY": "2022-06-07"
    }
  },
  "first_seen_precision": {
    "domain": {},
    "ipv4": {},
    "url": {}
  },
  "first_seen_range": {
    "earliest": "2019-06-19",
    "latest": "2022-06-07"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "0-day.us",
      "1688jtn.com",
      "41230077.net",
      "6474sss.com",
      "acorn-paper.com",
      "asaigoldenrice.com",
      "asdiamecwecw8cew.blogspot.com",
      "bjm9.blogspot.com",
      "brevini-france.cf",
      "buydildoonline.blogspot.com",
      "bylgay.hopto.org",
      "diamondfoxpanel.ml",
      "dixis.bounceme.net",
      "downloads.blogsyte.com",
      "emawattttson.blogspot.com",
      "fast-cargo.com",
      "gritodopovo.com.br",
      "grupomsi.com",
      "guelphupholstery.com",
      "hongmenwenhua.com",
      "ichoubyou.net",
      "klapki.online",
      "microsoftoutlook.duckdns.org",
      "miganshumarataa.blogspot.com",
      "ocha-gidi.xyz",
      "onedrivenet.xyz",
      "panelonetwothree.ga",
      "panelonetwothree.ml",
      "qp0o1j3-dmv4kwncw8e.win",
      "securebotnetpanel.tk",
      "stemtopx.com",
      "stevemike-fireforce.info",
      "stevemikeforce.com",
      "sukfat.com",
      "sxasxasxssaxxsasxasx.blogspot.com",
      "theaterloops.com",
      "thedip.zone",
      "tourismmanagement.mba",
      "treffictesgn.blogspot.com",
      "x-ghost91.ddns.net",
      "xaasxasxasx.blogspot.com",
      "xyz-storez.xyz",
      "ycsfuoabdicating.review",
      "zupaservices.info"
    ],
    "ipv4": [
      "196.185.215.228:81"
    ],
    "url": [
      "m9c.net/uploads/15882060891.jpg",
      "m9c.net/uploads/15882060892.jpg",
      "t2m.io/GbiSgY"
    ]
  },
  "last_modified": "2026-01-02T23:10:15+00:00",
  "maltrail_groups": [
    "GORGON"
  ],
  "references": [
    "https://app.any.run/tasks/bb1279af-7fff-4b37-8439-7b303f113082/",
    "https://app.any.run/tasks/c32b295c-08f4-4337-8f7f-378ba7f9e02b/",
    "https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Pakistan/APT/Gorgon/23-08-19/Malware%20analysis%2025-08-19.md",
    "https://github.com/pan-unit42/iocs/blob/master/gorgon/domains.txt",
    "https://otx.alienvault.com/pulse/5d1b49a55c01f486b6ff8cf2",
    "https://otx.alienvault.com/pulse/5d68fb8d77464e86898969f5",
    "https://otx.alienvault.com/pulse/5f34028dcae5e941a198b11d",
    "https://twitter.com/Arkbird_SOLG/status/1272512736795283456",
    "https://twitter.com/MisterCh0c/status/1188219763660591107",
    "https://twitter.com/Rmy_Reserve/status/1171381881461338112",
    "https://twitter.com/Zhx_8885/status/1227219569095262208",
    "https://twitter.com/h4ckak/status/1145984273985331200",
    "https://unit42.paloaltonetworks.com/aggah-campaign-bit-ly-blogspot-and-pastebin-used-for-c2-in-large-scale-campaign/",
    "https://www.seqrite.com/blog/gorgon-apt-targeting-msme-sector-in-india/",
    "https://www.virustotal.com/gui/domain/gritodopovo.com.br/relations",
    "https://www.virustotal.com/gui/file/24adef104d6f177525f24c927e764cf8e53c0ce50fbdd1c414305d5fc8b15116/detection",
    "https://www.virustotal.com/gui/file/6cb398873ff8759283d8aecc2077baaf56c30fa91490367f7431485ae8aee377/detection",
    "https://www.virustotal.com/gui/file/ec76393c14e8014ec4ffb6597699394b792696c97e1f25b2abc006884ea57b35/detection"
  ],
  "related": [
    {
      "evidence": [
        {
          "detail": "shares Remcos, njRAT, QuasarRAT",
          "kind": "software",
          "weight": 0.56
        }
      ],
      "slug": "G0099"
    },
    {
      "evidence": [
        {
          "detail": "shares Remcos, njRAT, QuasarRAT",
          "kind": "software",
          "weight": 0.56
        }
      ],
      "slug": "G0140"
    },
    {
      "evidence": [
        {
          "detail": "shares NanoCore, njRAT",
          "kind": "software",
          "weight": 0.5
        }
      ],
      "slug": "G0043"
    },
    {
      "evidence": [
        {
          "detail": "shares NanoCore",
          "kind": "software",
          "weight": 0.333
        }
      ],
      "slug": "G0064"
    }
  ],
  "slug": "G0078",
  "timeline": [
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2022-06-07",
      "indicators": {
        "url": [
          "t2m.io/GbiSgY"
        ]
      },
      "precision": "exact",
      "references": [
        "https://github.com/pan-unit42/iocs/blob/master/gorgon/domains.txt",
        "https://www.virustotal.com/gui/file/24adef104d6f177525f24c927e764cf8e53c0ce50fbdd1c414305d5fc8b15116/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-12-28",
      "indicators": {
        "domain": [
          "downloads.blogsyte.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/file/6cb398873ff8759283d8aecc2077baaf56c30fa91490367f7431485ae8aee377/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 1
      },
      "first_seen": "2020-08-18",
      "indicators": {
        "domain": [
          "x-ghost91.ddns.net"
        ],
        "ipv4": [
          "196.185.215.228:81"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/file/ec76393c14e8014ec4ffb6597699394b792696c97e1f25b2abc006884ea57b35/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "url": 2
      },
      "first_seen": "2020-08-12",
      "indicators": {
        "url": [
          "m9c.net/uploads/15882060891.jpg",
          "m9c.net/uploads/15882060892.jpg"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.seqrite.com/blog/gorgon-apt-targeting-msme-sector-in-india/",
        "https://otx.alienvault.com/pulse/5f34028dcae5e941a198b11d"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-06-15",
      "indicators": {
        "domain": [
          "dixis.bounceme.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Arkbird_SOLG/status/1272512736795283456"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-02-11",
      "indicators": {
        "domain": [
          "gritodopovo.com.br"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Zhx_8885/status/1227219569095262208",
        "https://www.virustotal.com/gui/domain/gritodopovo.com.br/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2019-10-27",
      "indicators": {
        "domain": [
          "bjm9.blogspot.com",
          "buydildoonline.blogspot.com",
          "emawattttson.blogspot.com",
          "miganshumarataa.blogspot.com",
          "treffictesgn.blogspot.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://unit42.paloaltonetworks.com/aggah-campaign-bit-ly-blogspot-and-pastebin-used-for-c2-in-large-scale-campaign/"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-10-27",
      "indicators": {
        "domain": [
          "asdiamecwecw8cew.blogspot.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/MisterCh0c/status/1188219763660591107",
        "https://app.any.run/tasks/c32b295c-08f4-4337-8f7f-378ba7f9e02b/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-09-10",
      "indicators": {
        "domain": [
          "sxasxasxssaxxsasxasx.blogspot.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Rmy_Reserve/status/1171381881461338112",
        "https://app.any.run/tasks/bb1279af-7fff-4b37-8439-7b303f113082/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 14
      },
      "first_seen": "2019-08-31",
      "indicators": {
        "domain": [
          "1688jtn.com",
          "41230077.net",
          "6474sss.com",
          "grupomsi.com",
          "hongmenwenhua.com",
          "ichoubyou.net",
          "klapki.online",
          "qp0o1j3-dmv4kwncw8e.win",
          "sukfat.com",
          "theaterloops.com",
          "thedip.zone",
          "tourismmanagement.mba",
          "xaasxasxasx.blogspot.com",
          "ycsfuoabdicating.review"
        ]
      },
      "precision": "exact",
      "references": [
        "https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Pakistan/APT/Gorgon/23-08-19/Malware%20analysis%2025-08-19.md",
        "https://otx.alienvault.com/pulse/5d68fb8d77464e86898969f5"
      ],
      "total": 14
    },
    {
      "counts": {
        "domain": 17
      },
      "first_seen": "2019-06-29",
      "indicators": {
        "domain": [
          "0-day.us",
          "acorn-paper.com",
          "asaigoldenrice.com",
          "brevini-france.cf",
          "diamondfoxpanel.ml",
          "fast-cargo.com",
          "guelphupholstery.com",
          "ocha-gidi.xyz",
          "onedrivenet.xyz",
          "panelonetwothree.ga",
          "panelonetwothree.ml",
          "securebotnetpanel.tk",
          "stemtopx.com",
          "stevemike-fireforce.info",
          "stevemikeforce.com",
          "xyz-storez.xyz",
          "zupaservices.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://github.com/pan-unit42/iocs/blob/master/gorgon/domains.txt",
        "https://www.virustotal.com/gui/file/24adef104d6f177525f24c927e764cf8e53c0ce50fbdd1c414305d5fc8b15116/detection"
      ],
      "total": 17
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2019-06-19",
      "indicators": {
        "domain": [
          "bylgay.hopto.org",
          "microsoftoutlook.duckdns.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h4ckak/status/1145984273985331200",
        "https://otx.alienvault.com/pulse/5d1b49a55c01f486b6ff8cf2"
      ],
      "total": 2
    }
  ]
}