FlagThis

← All Threat Actors
Threat Actor Profile

Gorgon Group

G0078 Pasty Draco TAG-CR5
▲ High Threat
[Gorgon Group](https://attack.mitre.org/groups/G0078) is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. The group has performed a mix of criminal and targeted attacks, including campaigns against government organizations in the United Kingdom, Spain, Russia, and the United States. (Citation: Unit 42 Gorgon Group Aug 2018)
Origin —

Known TTPs

Process Hollowing
Disable or Modify Tools
Deobfuscate/Decode Files or Information
Native API
Registry Run Keys / Startup Folder
PowerShell
Windows Command Shell
Ingress Tool Transfer
Spearphishing Attachment
Hidden Window
Portable Executable Injection
Modify Registry
Shortcut Modification
Malicious File
Tool
Visual Basic

External Resources

CISA Advisories ↗

Related Intelligence

Hacking the mainframe…
LINK COPIED TO CLIPBOARD