LiveActive security incident?Get immediate response
MITRE ATT&CK® Group

G0078: Gorgon Group

Gorgon Group is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. The group has performed a mix of criminal and targeted attacks, including campaigns against government organizations in the United Kingdom, Spain, Russia, and the United States. [1]

EnterpriseG0078GroupObject v1.5Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

G0078: Gorgon Group describes [Gorgon Group](https://attack.mitre.org/groups/G0078) is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. The group has performed a mix of criminal and targeted attacks, including campaigns against government organizations in the United Kingdom, Spain, Russia, and the United States. (Citation: Unit 42 Gorgon Group Aug 2018)

Executive priority

G0078: Gorgon Group is an official MITRE ATT&CK group. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate G0078: Gorgon Group by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

  • Official ATT&CK relationships and object metadata

Detection direction

  • Validate whether G0078: Gorgon Group appears in your detection coverage and tabletop scenarios.
  • Use the object to align executive risk language with SOC, incident response, and detection engineering work.
  • Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

  • Map the object to existing controls and identify missing telemetry or response ownership.
  • Prioritize mitigations that reduce exposure on the listed platforms and tactics.
  • Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Gorgon Group

Gorgon Group is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. The group has performed a mix of criminal and targeted attacks, including campaigns against government organizations in the United Kingdom, Spain, Russia, and the United States. [1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

16 rows
DomainIDNameRelationship / procedure
EnterpriseT1055.012Process HollowingSub-technique

Gorgon Group malware can use process hollowing to inject one of its trojans into another process.[1]

EnterpriseT1685Disable or Modify Tools

Gorgon Group malware can attempt to disable security features in Microsoft Office and Windows Defender using the taskkill command.[1]

EnterpriseT1140Deobfuscate/Decode Files or Information

Gorgon Group malware can decode contents from a payload that was Base64 encoded and write the contents to a file.[1]

EnterpriseT1106Native API

Gorgon Group malware can leverage the Windows API call, CreateProcessA(), for execution.[1]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.[1]

EnterpriseT1059.001PowerShellSub-technique

Gorgon Group malware can use PowerShell commands to download and execute a payload and open a decoy document on the victim’s machine.[1]

EnterpriseT1059.003Windows Command ShellSub-technique

Gorgon Group malware can use cmd.exe to download and execute payloads and to execute commands on the system.[1]

EnterpriseT1105Ingress Tool Transfer

Gorgon Group malware can download additional files from C2 servers.[1]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

Gorgon Group sent emails to victims with malicious Microsoft Office documents attached.[1]

EnterpriseT1564.003Hidden WindowSub-technique

Gorgon Group has used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden. [1]

EnterpriseT1055.002Portable Executable InjectionSub-technique

Gorgon Group malware can download a remote access tool, ShiftyBug, and inject into another process.[1]

EnterpriseT1112Modify Registry

Gorgon Group malware can deactivate security mechanisms in Microsoft Office by editing several keys and values under HKCU\Software\Microsoft\Office\.[1]

EnterpriseT1547.009Shortcut ModificationSub-technique

Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.[1]

EnterpriseT1204.002Malicious FileSub-technique

Gorgon Group attempted to get users to launch malicious Microsoft Office attachments delivered via spearphishing emails.[1]

EnterpriseT1588.002ToolSub-technique

Gorgon Group has obtained and used tools such as QuasarRAT and Remcos.[1]

EnterpriseT1059.005Visual BasicSub-technique

Gorgon Group has used macros in Spearphishing Attachments as well as executed VBScripts on victim machines.[1]

Associated objects

Groups, software, and campaigns

MalwareEnterprise

S0336: NanoCore

NanoCore is a modular remote access tool developed in .NET that can be used to spy on victims and steal information. It has been used by threat actors since 2013.[1][2][3][4]

Windows
ToolEnterprise

S0332: Remcos

Remcos is a closed-source tool that is marketed as a remote control and surveillance software by a company called Breaking Security. Remcos has been observed being used in malware campaigns.[1][2]

Windows
MalwareEnterprise

S0385: njRAT

njRAT is a remote access tool (RAT) that was first observed in 2012. It has been used by threat actors in the Middle East.[1]

Windows
Relationship explorer

All related ATT&CK context

uses · TechniqueT1055.012: Process HollowingEnterpriseuses · TechniqueT1685: Disable or Modify ToolsEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · MalwareS0336: NanoCoreEnterpriseuses · TechniqueT1566.001: Spearphishing AttachmentEnterpriseuses · TechniqueT1564.003: Hidden WindowEnterpriseuses · TechniqueT1055.002: Portable Executable InjectionEnterpriseuses · ToolS0262: QuasarRATEnterpriseuses · TechniqueT1112: Modify RegistryEnterpriseuses · TechniqueT1547.009: Shortcut ModificationEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · ToolS0332: RemcosEnterpriseuses · TechniqueT1588.002: ToolEnterpriseuses · MalwareS0385: njRATEnterpriseuses · TechniqueT1059.005: Visual BasicEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.2
Object version
1.5
Created
Modified
Raw hash
8815ec420a1653da...
Imported snapshots across ATT&CK releases(2)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.21.5Current bundle8815ec420a16…
19.11.5Older bundledc2aa87bf2f9…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  2. [2]
    Gorgon Group

    (Citation: Unit 42 Gorgon Group Aug 2018)

  3. [3]
    mitre-attackG0078
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use