Gorgon Group

Gorgon Group is a threat actor referenced in ATT&CK-style reporting and malware research datasets. In the provided content, the group is associated with spearphishing emails carrying malicious Microsoft Office attachments and attempts to get users to launch those attachments. Observed tradecraft includes use of PowerShell and cmd.exe to download and execute payloads, execute commands on victim systems, and open decoy documents; Base64 decoding of payload content and writing decoded content to disk; creation of .lnk files and Registry Run keys for persistence; and modification of HKCU\Software\Microsoft\Office\ registry keys to deactivate Microsoft Office security mechanisms. The group’s malware is also described as attempting to disable security features in Microsoft Office and Windows Defender using taskkill. The content states that Gorgon Group has obtained and used QuasarRAT and Remcos. Gorgon Group is also listed as one of 12 APT groups represented in an APT malware dataset. No additional aliases, sub-groups, or nation-state attribution are directly provided in the content.