Loading threat actor…
Gorgon Group is a Pakistan-linked threat actor associated with spearphishing-led intrusions and commodity malware-enabled espionage activity. The group has been described as operating in a state-sponsored model and is notable for targeting victims both within South Asia and outside the region. Known aliases include Gorgon, GorgonGroup, and The Gorgon Group. Gorgon Group commonly relies on spearphishing emails carrying malicious Microsoft Office documents to induce user execution. Observed tradecraft includes use of PowerShell, hidden PowerShell windows, command-shell execution, Base64-decoded payload content, and malware capable of downloading additional files from command-and-control infrastructure. The group has used remote access and surveillance tooling including NanoCore, QuasarRAT, Remcos, and AZORult. Windows persistence and defense evasion are recurring elements of the group’s operations. Reported behaviors include creation of shortcut-based persistence and Registry Run-key autoruns, as well as modification of Microsoft Office security-related settings to weaken protections. The group’s malware has also been observed using command execution through cmd.exe and staging follow-on payloads after initial compromise. The overall pattern is consistent with credential and information collection enabled by phishing-based initial access, stealthy execution, persistence through common Windows autoruns, and follow-on payload delivery using widely available RAT and stealer malware.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
26 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
6 malware families attributed to this actor across reporting.
1 additional family tracked in Mallory.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
31 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as a threat actor associated with PowerShell execution behavior relevant to this detection.
Listed as a threat actor associated with the PowerShell P/Invoke process injection API chain detection and related ATT&CK techniques.
Listed as a threat actor associated with PowerShell execution behavior relevant to this detection analytic.
Referenced as a threat actor associated with registry modification behavior (MITRE ATT&CK T1112: Modify Registry) in the context of this detection analytic.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.