NEW: Group Profiler — instant APT intel lookup. Try it →
Emblem illustrating the Gorgon Group threat group

Gorgon Group

G0078 Pakistan MITRE ATT&CK →

Overview

Gorgon Group is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. The group has performed a mix of criminal and targeted attacks, including campaigns against government organizations in the United Kingdom, Spain, Russia, and the United States.

Naming & attribution

It uses 16 documented ATT&CK techniques — more than 45% of the 174 groups tracked here.

Who calls this group what — MITRE lists each alias with the report that used it, but not which vendor coined it.
NameFirst reported by
Gorgon GroupFalcone, R., et al

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

  • T1055.002 Portable Executable Injection — used by 2 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

  • Nomadic Octopus Russia — 6 shared techniques (35% overlap)
  • Silence — 10 shared techniques (29% overlap)
  • TA505 — 11 shared techniques (28% overlap)
  • APT19 China — 8 shared techniques (28% overlap)
  • Molerats — 7 shared techniques (28% overlap)
  • DarkHydrus — 5 shared techniques (28% overlap)

Malware families with tracked indicators

2 families attributed to Gorgon Group, with 1,020 deduplicated indicators observed across abuse.ch ThreatFox, MalwareBazaar, URLhaus and SSLBL over the corpus's window (up to three years, as of 2026-09-26). MITRE documents what a group does; these are the indicators its malware families have surfaced in that window.

  • NanoCore 545 indicators
  • Remcos 475 indicators

Browse or copy the indicators by hash, domain, IP or URL, filtered by age from 1 day to 3 years.

TTPs — 16 techniques across 7 tactics

Resource Development

Initial Access

Execution

Persistence

Stealth

Defense Impairment

Command and Control

Tools & malware (4)

NanoCore · QuasarRAT · Remcos · njRAT

Reporting (1)

Need the matrix overlay, mind-map, or technique-flow view? Open the interactive Group Profiler in a browser with JavaScript enabled.