AdversaryGraph public intelligence page

This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.

Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.

Main AdversaryGraph project Documentation Malware Analysis GitHub

G0078 · 16 ATT&CK techniques · 0 correlated reports

Gorgon Group

Aliases: None listed

Gorgon Group is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. The group has performed a mix of criminal and targeted attacks, including campaigns against government organizations in the United Kingdom, Spain, Russia, and the United States.

Open interactive actor investigation

ATT&CK techniques

T1055.012
Process HollowingT1140
Deobfuscate/Decode Files or InformationT1106
Native APIT1547.001
Registry Run Keys / Startup FolderT1059.001
PowerShellT1059.003
Windows Command ShellT1105
Ingress Tool TransferT1566.001
Spearphishing AttachmentT1564.003
Hidden WindowT1055.002
Portable Executable InjectionT1562.001
Disable or Modify ToolsT1112
Modify RegistryT1547.009
Shortcut ModificationT1204.002
Malicious FileT1588.002
ToolT1059.005
Visual Basic

Correlated CTI and IR reports

Continue the investigation

Interactive AdversaryGraph AdversaryGraph documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas Insider Threat Detection Guide 1200km Medium research

Cyber Knowledge routes

These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.

Module 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameModule 7 — Endpoint defense and EDR
Blue Team & Defensive Security · topic-matchModule 13 — AI-assisted defense, RAG, agents, and MCP
Blue Team & Defensive Security · topic-matchMemory forensics, injection, and resident behavior
Malware Analysis & Reverse Engineering · topic-matchPrompt injection, instruction hierarchy, and secure output handling
AI Security · topic-matchModule 2 — The Intelligence Cycle Intelligence Types
Cyber Threat Intelligence (CTI) · topic-matchModule 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · topic-matchSource review and static analysis
Vulnerability Research & Exploit Development · topic-matchModule 9 — Identity defense and ITDR
Blue Team & Defensive Security · topic-matchModule 12 — Incident response, DFIR, crisis coordination, and recovery
Blue Team & Defensive Security · topic-match