G0078 · 16 ATT&CK techniques · 0 correlated reports

Gorgon Group

Aliases: None listed

Gorgon Group is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. The group has performed a mix of criminal and targeted attacks, including campaigns against government organizations in the United Kingdom, Spain, Russia, and the United States.

Open interactive actor investigation

ATT&CK techniques

T1055.012
Process Hollowing T1140
Deobfuscate/Decode Files or Information T1106
Native API T1547.001
Registry Run Keys / Startup Folder T1059.001
PowerShell T1059.003
Windows Command Shell T1105
Ingress Tool Transfer T1566.001
Spearphishing Attachment T1564.003
Hidden Window T1055.002
Portable Executable Injection T1562.001
Disable or Modify Tools T1112
Modify Registry T1547.009
Shortcut Modification T1204.002
Malicious File T1588.002
Tool T1059.005
Visual Basic

Correlated CTI and IR reports

Continue the investigation

Interactive ThreatMapper ThreatMapper documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas ITDR Handbook 1200km Medium research