Gorgon Group - G0078

Created: 2018-10-17T00:14:20.652Z

Modified: 2021-10-12T21:57:25.847Z

Contributors:

Aliases

Gorgon Group

Description

Gorgon Group is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. The group has performed a mix of criminal and targeted attacks, including campaigns against government organizations in the United Kingdom, Spain, Russia, and the United States. (Citation: Unit 42 Gorgon Group Aug 2018)

Techniques Used

Gorgon Group has obtained and used tools such as

QuasarRAT and

Remcos.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1564.003|Hidden Window|

Gorgon Group has used

PowerShell windows by setting the WindowStyle parameter to hidden. (Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|

Gorgon Group malware can decode contents from a payload that was Base64 encoded and write the contents to a file.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Gorgon Group malware can download additional files from C2 servers.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Windows|T1055.002|Portable Executable Injection|

Gorgon Group malware can download a remote access tool,

ShiftyBug, and inject into another process.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Windows|T1055.012|Process Hollowing|