Gorgon Group

Gorgon Group is a Pakistan-linked threat actor tracked in ATT&CK as G0078. The group has been associated with spearphishing-led intrusions that rely heavily on malicious Microsoft Office attachments and other socially engineered lures to induce user execution. Its activity has targeted victims in South Asia while also extending beyond the region, indicating a broader victimology than some regionally focused operators. The group is known for using commodity and custom malware, including historical use of NanoCore, to establish remote access and stage follow-on payloads. Observed tradecraft includes delivery of malicious Office documents via email, use of PowerShell for payload download and execution, and command-shell activity to retrieve or launch additional components. Gorgon Group has used hidden PowerShell execution, including WindowStyle-hidden variants, to reduce user visibility during execution. On compromised Windows systems, Gorgon Group malware has demonstrated persistence through creation of Registry Run entries and Startup-folder shortcut mechanisms. The group has also modified Microsoft Office-related registry settings to weaken or deactivate security protections, and has attempted to disable defensive controls in Microsoft Office and Windows Defender. Additional observed behaviors include Base64 decoding of payload content before writing it to disk and downloading further files from command-and-control infrastructure. Aliases include Gorgon, gorgon_group, and the_gorgon_group. The actor is generally characterized by phishing-centric initial access, straightforward but effective Windows persistence, PowerShell-enabled staging, registry modification for both persistence and defense evasion, and use of readily available malware tooling alongside bespoke intrusion activity.