AdversaryGraph public intelligence page

This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.

Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.

Main AdversaryGraph project Documentation Malware Analysis GitHub

G0078 · 16 ATT&CK techniques · 0 correlated reports

Gorgon Group

Aliases: Gorgon Group

[Gorgon Group](https://attack.mitre.org/groups/G0078) is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. The group has performed a mix of criminal and targeted attacks, including campaigns against government organizations in the United Kingdom, Spain, Russia, and the United States. (Citation: Unit 42 Gorgon Group Aug 2018)

Open interactive actor investigation

ATT&CK techniques

T1055.002T1055.012T1059.001T1059.003T1059.005T1105T1106T1112T1140T1204.002T1547.001T1547.009T1564.003T1566.001T1588.002T1685

Correlated CTI and IR reports

Continue the investigation

Interactive AdversaryGraph AdversaryGraph documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas Insider Threat Detection Guide 1200km Medium research

Attack tools, simulations and detection rules

Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.

QuasarRAT tool reference — Explicit actor uses software relationship in pinned ATT&CK
Remcos tool reference — Explicit actor uses software relationship in pinned ATT&CK
T1055.002 Portable Executable Injection simulation — Exact active technique ID
T1055.002 detection rules — Exact active technique ID; not actor-specific detector coverage
T1055.012 Process Hollowing simulation — Exact active technique ID
T1055.012 detection rules — Exact active technique ID; not actor-specific detector coverage
T1059.001 PowerShell simulation — Exact active technique ID
T1059.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1059.003 Windows Command Shell simulation — Exact active technique ID
T1059.003 detection rules — Exact active technique ID; not actor-specific detector coverage
T1059.005 Visual Basic simulation — Exact active technique ID
T1059.005 detection rules — Exact active technique ID; not actor-specific detector coverage
T1105 Ingress Tool Transfer simulation — Exact active technique ID
T1105 detection rules — Exact active technique ID; not actor-specific detector coverage
T1106 Native API simulation — Exact active technique ID
T1106 detection rules — Exact active technique ID; not actor-specific detector coverage
T1112 Modify Registry simulation — Exact active technique ID
T1112 detection rules — Exact active technique ID; not actor-specific detector coverage
T1140 Deobfuscate/Decode Files or Information simulation — Exact active technique ID
T1140 detection rules — Exact active technique ID; not actor-specific detector coverage
T1204.002 Malicious File simulation — Exact active technique ID
T1204.002 detection rules — Exact active technique ID; not actor-specific detector coverage
T1547.001 Registry Run Keys / Startup Folder simulation — Exact active technique ID
T1547.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1547.009 Shortcut Modification simulation — Exact active technique ID
T1547.009 detection rules — Exact active technique ID; not actor-specific detector coverage
T1564.003 Hidden Window simulation — Exact active technique ID
T1564.003 detection rules — Exact active technique ID; not actor-specific detector coverage
T1566.001 Spearphishing Attachment simulation — Exact active technique ID
T1566.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1588.002 Tool simulation — Exact active technique ID
T1588.002 detection rules — Exact active technique ID; not actor-specific detector coverage
T1685 Disable or Modify Tools simulation — Exact active technique ID
T1685 detection rules — Exact active technique ID; not actor-specific detector coverage

Cyber Knowledge routes

These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.

Module 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-id Module 5 — Threat hunting
Blue Team & Defensive Security · explicit-name Windows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-name Module 7 — Endpoint defense and EDR
Blue Team & Defensive Security · topic-match Module 13 — AI-assisted defense, RAG, agents, and MCP
Blue Team & Defensive Security · topic-match Memory forensics, injection, and resident behavior
Malware Analysis & Reverse Engineering · topic-match Prompt injection, instruction hierarchy, and secure output handling
AI Security · topic-match Module 2 — The Intelligence Cycle Intelligence Types
Cyber Threat Intelligence (CTI) · topic-match Module 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · topic-match Source review and static analysis
Vulnerability Research & Exploit Development · topic-match Module 9 — Identity defense and ITDR
Blue Team & Defensive Security · topic-match Module 12 — Incident response, DFIR, crisis coordination, and recovery
Blue Team & Defensive Security · topic-match