LiveActive security incident?Get immediate response
MITRE ATT&CK® Group

G0078: Gorgon Group

Gorgon Group is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. The group has performed a mix of criminal and targeted attacks, including campaigns against government organizations in the United Kingdom, Spain, Russia, and the United States. [1]

EnterpriseG0078GroupObject v1.5Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Gorgon Group matters because ATT&CK links it to both targeted government campaigns and criminal-style activity, with observed use of commodity remote access tools such as QuasarRAT, Remcos, NanoCore, and njRAT. For leaders, the defensive takeaway is not a single bespoke actor profile; it is whether the organization can detect and contain common RAT-enabled intrusion patterns that start with malicious attachments and progress through script execution, registry/startup persistence, tool transfer, and stealthy process behavior.

Executive priority

Prioritize this as a readiness test for phishing resilience, Windows endpoint visibility, and incident response containment of remote access tooling. The ATT&CK record does not provide active-exploitation or sector-specific exposure claims, but it does show a group associated with campaigns against government organizations in multiple countries and a technique set that can support unauthorized access, persistence, defense evasion, and command-and-control. Executives should ask whether email security, endpoint logging, SOC triage, and IR playbooks can prove coverage for malicious files, PowerShell/cmd/VB execution, registry persistence, and RAT activity rather than relying only on malware names.

Technical view

The relationship context points defenders toward validating behavior-based coverage around spearphishing attachments, user-opened malicious files, Windows scripting and command execution, registry modification, Run Keys/startup folders, shortcut persistence, process injection/hollowing, deobfuscation, hidden windows, ingress tool transfer, native API execution, and attempts to disable or modify defensive tools. Several related software entries are Windows RATs, so Windows endpoint telemetry is especially important where those tools are relevant; however, the group object itself does not specify platforms or tactics. SOC teams should correlate attachment delivery and user execution with child processes, script interpreter activity, suspicious persistence writes, unusual network connections, and endpoint-defense tampering indicators.

Likely telemetry

  • Email gateway and mailbox telemetry for spearphishing attachments and user interaction with malicious files
  • Endpoint process creation and command-line telemetry for PowerShell, cmd, Visual Basic, and suspicious child processes
  • Windows Registry and startup folder monitoring for Run Keys, persistence entries, and shortcut modification
  • Endpoint memory/process telemetry capable of surfacing PE injection or process hollowing indicators
  • Network and proxy/DNS telemetry for remote access tool communications and ingress tool transfer

Detection direction

  • Validate detections by behavior chain, not only by signatures for QuasarRAT, Remcos, NanoCore, or njRAT, because the related tooling includes publicly available or commercial remote access software that may vary by build and configuration.
  • Tune PowerShell, cmd, and Visual Basic analytics to distinguish routine administration from suspicious execution following email attachment activity or from unusual user-writable paths.
  • Monitor registry and startup persistence changes in user and system contexts, with allowlists for approved software installers and administrative scripts.
  • Correlate process injection/hollowing signals with parent process lineage, unsigned or unexpected binaries, and post-execution network activity to reduce false positives.
  • Include visibility checks for endpoint security impairment, since related behavior includes disabling or modifying tools; absence of telemetry from a host should be treated as an investigative signal, not just a data gap.

Mitigation priorities

  • Strengthen attachment handling, user reporting, and safe execution controls for files delivered by email.
  • Harden and monitor script interpreters and command shells, especially PowerShell, cmd, and Visual Basic usage on Windows endpoints.
  • Restrict unauthorized persistence mechanisms by monitoring and controlling Registry Run Keys, startup folders, and shortcut modifications.
  • Maintain endpoint protection and logging resilience, including alerting on disabled or modified security tools and gaps in agent check-in.
  • Control outbound network paths and file transfer opportunities used for tool ingress, while preserving logs needed for investigation.
Additional notes and limits

This take is based on the supplied ATT&CK group description, external references, and explicit relationships. The most decision-useful context is the combination of suspected Pakistan connections, campaigns against government organizations in the UK, Spain, Russia, and the US, and the linked use of multiple RATs plus execution, persistence, stealth, command-and-control, and defense-impairment techniques. The relationship set is suitable for control validation and detection planning, but it should not be treated as a complete or current campaign profile without additional intelligence.

MITRE does not provide official detection guidance for this group object, and the group-level platforms and tactics are not specified. Several platform statements come from related techniques and software rather than the group object itself. No claim is made here about active exploitation, current targeting, attribution certainty, or guaranteed detection coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Gorgon Group

Gorgon Group is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. The group has performed a mix of criminal and targeted attacks, including campaigns against government organizations in the United Kingdom, Spain, Russia, and the United States. [1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

16 rows
DomainIDNameRelationship / procedure
EnterpriseT1055.012Process HollowingSub-technique

Gorgon Group malware can use process hollowing to inject one of its trojans into another process.[1]

EnterpriseT1685Disable or Modify Tools

Gorgon Group malware can attempt to disable security features in Microsoft Office and Windows Defender using the taskkill command.[1]

EnterpriseT1140Deobfuscate/Decode Files or Information

Gorgon Group malware can decode contents from a payload that was Base64 encoded and write the contents to a file.[1]

EnterpriseT1106Native API

Gorgon Group malware can leverage the Windows API call, CreateProcessA(), for execution.[1]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.[1]

EnterpriseT1059.001PowerShellSub-technique

Gorgon Group malware can use PowerShell commands to download and execute a payload and open a decoy document on the victim’s machine.[1]

EnterpriseT1059.003Windows Command ShellSub-technique

Gorgon Group malware can use cmd.exe to download and execute payloads and to execute commands on the system.[1]

EnterpriseT1105Ingress Tool Transfer

Gorgon Group malware can download additional files from C2 servers.[1]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

Gorgon Group sent emails to victims with malicious Microsoft Office documents attached.[1]

EnterpriseT1564.003Hidden WindowSub-technique

Gorgon Group has used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden. [1]

EnterpriseT1055.002Portable Executable InjectionSub-technique

Gorgon Group malware can download a remote access tool, ShiftyBug, and inject into another process.[1]

EnterpriseT1112Modify Registry

Gorgon Group malware can deactivate security mechanisms in Microsoft Office by editing several keys and values under HKCU\Software\Microsoft\Office\.[1]

EnterpriseT1547.009Shortcut ModificationSub-technique

Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.[1]

EnterpriseT1204.002Malicious FileSub-technique

Gorgon Group attempted to get users to launch malicious Microsoft Office attachments delivered via spearphishing emails.[1]

EnterpriseT1588.002ToolSub-technique

Gorgon Group has obtained and used tools such as QuasarRAT and Remcos.[1]

EnterpriseT1059.005Visual BasicSub-technique

Gorgon Group has used macros in Spearphishing Attachments as well as executed VBScripts on victim machines.[1]

Associated objects

Groups, software, and campaigns

MalwareEnterprise

S0336: NanoCore

NanoCore is a modular remote access tool developed in .NET that can be used to spy on victims and steal information. It has been used by threat actors since 2013.[1][2][3][4]

Windows
ToolEnterprise

S0332: Remcos

Remcos is a closed-source tool that is marketed as a remote control and surveillance software by a company called Breaking Security. Remcos has been observed being used in malware campaigns.[1][2]

Windows
MalwareEnterprise

S0385: njRAT

njRAT is a remote access tool (RAT) that was first observed in 2012. It has been used by threat actors in the Middle East.[1]

Windows
Relationship explorer

All related ATT&CK context

uses · TechniqueT1055.012: Process HollowingEnterpriseuses · TechniqueT1685: Disable or Modify ToolsEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · MalwareS0336: NanoCoreEnterpriseuses · TechniqueT1566.001: Spearphishing AttachmentEnterpriseuses · TechniqueT1564.003: Hidden WindowEnterpriseuses · TechniqueT1055.002: Portable Executable InjectionEnterpriseuses · ToolS0262: QuasarRATEnterpriseuses · TechniqueT1112: Modify RegistryEnterpriseuses · TechniqueT1547.009: Shortcut ModificationEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · ToolS0332: RemcosEnterpriseuses · TechniqueT1588.002: ToolEnterpriseuses · MalwareS0385: njRATEnterpriseuses · TechniqueT1059.005: Visual BasicEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.5
Created
Modified
Raw hash
dc2aa87bf2f97fd1...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.5Current bundledc2aa87bf2f9…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  2. [2]
    Gorgon Group

    (Citation: Unit 42 Gorgon Group Aug 2018)

  3. [3]
    Gorgon Group

    (Citation: Unit 42 Gorgon Group Aug 2018)

  4. [4]
    Gorgon Group

    (Citation: Unit 42 Gorgon Group Aug 2018)

  5. [5]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  6. [6]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  7. [7]
    mitre-attackG0078
    Open source URL
  8. [8]
    mitre-attackG0078
    Open source URL
  9. [9]
    mitre-attackG0078
    Open source URL
  10. [10]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  11. [11]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  12. [12]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  13. [13]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  14. [14]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  15. [15]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  16. [16]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  17. [17]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  18. [18]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  19. [19]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  20. [20]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  21. [21]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  22. [22]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  23. [23]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  24. [24]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  25. [25]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  26. [26]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  27. [27]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  28. [28]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  29. [29]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  30. [30]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  31. [31]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  32. [32]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  33. [33]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  34. [34]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  35. [35]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  36. [36]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  37. [37]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  38. [38]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  39. [39]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  40. [40]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  41. [41]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  42. [42]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  43. [43]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  44. [44]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  45. [45]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  46. [46]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  47. [47]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
  48. [48]
    Unit 42 Gorgon Group Aug 2018

    Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use