Group5 — ATT&CK profile, 4 techniques

Overview

Group5 is a threat group with a suspected Iranian nexus, though this attribution is not definite. The group has targeted individuals connected to the Syrian opposition via spearphishing and watering holes, normally using Syrian and Iranian themes. Group5 has used two commonly available remote access tools (RATs), njRAT and NanoCore, as well as an Android RAT, DroidJack.

Naming & attribution

Group5 is tracked under 1 names across the industry. It uses 4 documented ATT&CK techniques — more than 9% of the 174 groups tracked here.

Who calls this group what — MITRE lists each alias with the report that used it, but not which vendor coined it.
Name	First reported by
Group5	Scott-Railton, J., et al

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

APT39 Iran — 4 shared techniques (8% overlap)
menuPass China — 3 shared techniques (6% overlap)
Magic Hound Iran — 4 shared techniques (5% overlap)
OilRig Iran — 4 shared techniques (5% overlap)
Threat Group-3390 China — 3 shared techniques (5% overlap)
APT28 Russia — 4 shared techniques (4% overlap)

Malware families with current indicators

One family attributed to Group5, carrying 256 indicators currently tracked from abuse.ch ThreatFox, MalwareBazaar, URLhaus and SSLBL. MITRE documents what a group does; this is what its tooling is doing now.

NanoCore 256 indicators

Browse or copy the indicators by hash, domain, IP or URL, filtered by age from 1 day to 3 years.

TTPs — 4 techniques across 2 tactics

Stealth

T1027.013 Encrypted/Encoded File
T1070.004 File Deletion

Collection

T1056.001 Keylogging
T1113 Screen Capture

Tools & malware (2)

njRAT · NanoCore

Reporting (1)

Group5: Syria and the Iranian Connection — Scott-Railton, J., et al