Gorgon Group
Associated Group Descriptions |
|
| Name | Description |
|---|---|
Techniques Used |
||||
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1547 | .001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.(Citation: Unit 42 Gorgon Group Aug 2018) |
| .009 | Boot or Logon Autostart Execution: Shortcut Modification |
Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.(Citation: Unit 42 Gorgon Group Aug 2018) |
||
| Enterprise | T1059 | .001 | Command and Scripting Interpreter: PowerShell |
Gorgon Group malware can use PowerShell commands to download and execute a payload and open a decoy document on the victim’s machine.(Citation: Unit 42 Gorgon Group Aug 2018) |
| .003 | Command and Scripting Interpreter: Windows Command Shell |
Gorgon Group malware can use cmd.exe to download and execute payloads and to execute commands on the system.(Citation: Unit 42 Gorgon Group Aug 2018) |
||
| .005 | Command and Scripting Interpreter: Visual Basic |
Gorgon Group has used macros in Spearphishing Attachments as well as executed VBScripts on victim machines.(Citation: Unit 42 Gorgon Group Aug 2018) |
||
| Enterprise | T1564 | .003 | Hide Artifacts: Hidden Window |
Gorgon Group has used |
| Enterprise | T1562 | .001 | Impair Defenses: Disable or Modify Tools |
Gorgon Group malware can attempt to disable security features in Microsoft Office and Windows Defender using the |
| Enterprise | T1588 | .002 | Obtain Capabilities: Tool |
Gorgon Group has obtained and used tools such as QuasarRAT and Remcos.(Citation: Unit 42 Gorgon Group Aug 2018) |
| Enterprise | T1566 | .001 | Phishing: Spearphishing Attachment |
Gorgon Group sent emails to victims with malicious Microsoft Office documents attached.(Citation: Unit 42 Gorgon Group Aug 2018) |
| Enterprise | T1055 | .002 | Process Injection: Portable Executable Injection |
Gorgon Group malware can download a remote access tool, ShiftyBug, and inject into another process.(Citation: Unit 42 Gorgon Group Aug 2018) |
| .012 | Process Injection: Process Hollowing |
Gorgon Group malware can use process hollowing to inject one of its trojans into another process.(Citation: Unit 42 Gorgon Group Aug 2018) |
||
| Enterprise | T1204 | .002 | User Execution: Malicious File |
Gorgon Group attempted to get users to launch malicious Microsoft Office attachments delivered via spearphishing emails.(Citation: Unit 42 Gorgon Group Aug 2018) |
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.