ShiftyBug, and inject into another process.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Windows|T1055.012|Process Hollowing|

Gorgon Group malware can use process hollowing to inject one of its trojans into another process.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Gorgon Group sent emails to victims with malicious Microsoft Office documents attached.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

Gorgon Group has used macros in

Spearphishing Attachments as well as executed VBScripts on victim machines.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Containers,IaaS|T1562.001|Disable or Modify Tools|

Gorgon Group malware can attempt to disable security features in Microsoft Office and Windows Defender using the

Gorgon Group malware can use cmd.exe to download and execute payloads and to execute commands on the system.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Windows|T1547.009|Shortcut Modification|

Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Gorgon Group malware can use PowerShell commands to download and execute a payload and open a decoy document on the victim’s machine.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|