Gorgon Group

Overview

Gorgon Group is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. The group has performed a mix of criminal and targeted attacks, including campaigns against government organizations in the United Kingdom, Spain, Russia, and the United States.

Naming & attribution

Gorgon Group is tracked under 1 names across the industry. It uses 16 documented ATT&CK techniques — more than 45% of the 174 groups tracked here.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

• T1055.002 Portable Executable Injection — used by 2 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• Nomadic Octopus Russia — 6 shared techniques (35% overlap)
• Silence — 10 shared techniques (29% overlap)
• TA505 — 11 shared techniques (28% overlap)
• APT19 China — 8 shared techniques (28% overlap)
• Molerats — 7 shared techniques (28% overlap)
• DarkHydrus — 5 shared techniques (28% overlap)

TTPs — 16 techniques across 7 tactics

Tools & malware (4)

NanoCore · QuasarRAT · Remcos · njRAT

Reporting (1)

• The Gorgon Group: Slithering Between Nation State and Cybercrime — Falcone, R., et al