Group5 — ATT&CK profile, 4 techniques

Overview

Group5 is a threat group with a suspected Iranian nexus, though this attribution is not definite. The group has targeted individuals connected to the Syrian opposition via spearphishing and watering holes, normally using Syrian and Iranian themes. Group5 has used two commonly available remote access tools (RATs), njRAT and NanoCore, as well as an Android RAT, DroidJack.

Naming & attribution

It uses 4 documented ATT&CK techniques — more than 9% of the 174 groups tracked here.

Who calls this group what — MITRE lists each alias with the report that used it, but not which vendor coined it.
Name	First reported by
Group5	Scott-Railton, J., et al

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

APT39 Iran — 4 shared techniques (8% overlap)
menuPass China — 3 shared techniques (6% overlap)
Magic Hound Iran — 4 shared techniques (5% overlap)
OilRig Iran — 4 shared techniques (5% overlap)
Threat Group-3390 China — 3 shared techniques (5% overlap)
APT28 Russia — 4 shared techniques (4% overlap)

Malware families with tracked indicators

One family attributed to Group5, with 545 deduplicated indicators observed across abuse.ch ThreatFox, MalwareBazaar, URLhaus and SSLBL over the corpus's window (up to three years, as of 2026-09-26). MITRE documents what a group does; these are the indicators its malware families have surfaced in that window.

NanoCore 545 indicators

Browse or copy the indicators by hash, domain, IP or URL, filtered by age from 1 day to 3 years.

TTPs — 4 techniques across 2 tactics

Stealth

T1027.013 Encrypted/Encoded File
T1070.004 File Deletion

Collection

T1056.001 Keylogging
T1113 Screen Capture

Tools & malware (2)

njRAT · NanoCore

Reporting (1)

Group5: Syria and the Iranian Connection — Scott-Railton, J., et al