Gorgon Group
Gorgon Group is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. The group has performed a mix of criminal and targeted attacks, including campaigns against government organizations in the United Kingdom, Spain, Russia, and the United States. [1]
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1112 | 修改注册表 |
Gorgon Group malware can deactivate security mechanisms in Microsoft Office by editing several keys and values under |
|
| Enterprise | T1140 | 反混淆/解码文件或信息 |
Gorgon Group malware can decode contents from a payload that was Base64 encoded and write the contents to a file.[1] |
|
| Enterprise | T1547 | .001 | 启动或登录自动启动执行: Registry Run Keys / Startup Folder |
Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.[1] |
| .009 | 启动或登录自动启动执行: Shortcut Modification |
Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.[1] |
||
| Enterprise | T1059 | .001 | 命令与脚本解释器: PowerShell |
Gorgon Group malware can use PowerShell commands to download and execute a payload and open a decoy document on the victim’s machine.[1] |
| .003 | 命令与脚本解释器: Windows Command Shell |
Gorgon Group malware can use cmd.exe to download and execute payloads and to execute commands on the system.[1] |
||
| .005 | 命令与脚本解释器: Visual Basic |
Gorgon Group has used macros in Spearphishing Attachments as well as executed VBScripts on victim machines.[1] |
||
| Enterprise | T1562 | .001 | 妨碍防御: Disable or Modify Tools |
Gorgon Group malware can attempt to disable security features in Microsoft Office and Windows Defender using the |
| Enterprise | T1106 | 本机API |
Gorgon Group malware can leverage the Windows API call, CreateProcessA(), for execution.[1] |
|
| Enterprise | T1204 | .002 | 用户执行: Malicious File |
Gorgon Group attempted to get users to launch malicious Microsoft Office attachments delivered via spearphishing emails.[1] |
| Enterprise | T1588 | .002 | 获取能力: Tool |
Gorgon Group has obtained and used tools such as QuasarRAT and Remcos.[1] |
| Enterprise | T1105 | 输入工具传输 |
Gorgon Group malware can download additional files from C2 servers.[1] |
|
| Enterprise | T1055 | .002 | 进程注入: Portable Executable Injection |
Gorgon Group malware can download a remote access tool, ShiftyBug, and inject into another process.[1] |
| .012 | 进程注入: Process Hollowing |
Gorgon Group malware can use process hollowing to inject one of its trojans into another process.[1] |
||
| Enterprise | T1566 | .001 | 钓鱼: Spearphishing Attachment |
Gorgon Group sent emails to victims with malicious Microsoft Office documents attached.[1] |
| Enterprise | T1564 | .003 | 隐藏伪装: Hidden Window |
Gorgon Group has used |