{
  "family": "gorgon",
  "sample_count": 13,
  "category": "advanced_threat",
  "description": "The Gorgon Group (also tracked as Subaat) is a unique cyber threat actor, primarily operating out of Pakistan, that blurs the lines between a state-sponsored Advanced Persistent Threat (APT) and a financially motivated cybercriminal syndicate. Active since at least 2018, Gorgon Group is notorious for conducting dual-track operations: simultaneously launching targeted espionage campaigns against government entities worldwide (particularly in the UK, Spain, Russia, and the US) while concurrently running massive, unsophisticated malspam campaigns to steal credit cards and deploy commodity malware for immediate financial gain.<br><br><b>Understanding Gorgon Group Operations</b><br>To a victim, a Gorgon Group attack typically begins with a phishing email. For a threat intelligence analyst, Gorgon Group is fascinating because of their 'smash and grab' approach to espionage. They rarely use custom, zero-day exploits. Instead, they rely heavily on off-the-shelf commodity tools (like njRAT, Remcos RAT, and Agent Tesla), publicly available exploit builders (like Microsoft Office Equation Editor exploits), and 'Living off the Land' (LotL) techniques utilizing PowerShell and VBScript. Their infrastructure is often shared between their espionage and criminal campaigns.<br><br><b>Execution and Tooling Mechanics</b><br>Gorgon campaigns almost universally begin with spearphishing (`T1566.001`). The emails contain weaponized Word documents that exploit known vulnerabilities like CVE-2017-11882 (Equation Editor) (`T1190`). Once the exploit executes, it typically drops a VBScript or PowerShell downloader (`T1059.001`). This script reaches out to infrastructure often hosted on Pastebin, Bitly, or compromised WordPress sites to pull down the final payload (`T1105`). For criminal campaigns, this is usually a password stealer like Agent Tesla (`T1056.001`). For espionage campaigns, it is often a RAT (like njRAT or Quasar) configured to establish long-term persistence via Registry Run keys (`T1547.001`) and exfiltrate sensitive documents (`T1005`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from financial fraud to the theft of sensitive government intelligence. Detection heavily relies on identifying the initial Office exploitation and the subsequent anomalous script execution. Look for `EQNEDT32.EXE` spawning `cmd.exe`, `wscript.exe`, or `powershell.exe`. Network logs will frequently show these scripts attempting to connect to free file-hosting services (like Pastebin) or dynamic DNS providers (like DuckDNS) to download payloads.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1056.001",
    "T1190",
    "T1105",
    "T1059.001",
    "T1566.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1190",
      "name": "Exploit Public-Facing Application (CVE-2017-11882)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1059.001",
      "name": "Command and Scripting Interpreter: PowerShell",
      "tactic": "Execution"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging (via commodity RATs)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Isolate the compromised endpoint; determine if the payload is a generic stealer (criminal track) or a persistent RAT (espionage track).",
    "Identify the initial phishing vector and search enterprise email logs for similar emails to find other potentially compromised users.",
    "Ensure all Microsoft Office installations are fully patched against CVE-2017-11882 and related Equation Editor vulnerabilities, as Gorgon relies heavily on these old exploits.",
    "Audit the endpoint's Registry Run keys and Scheduled Tasks to remove the persistence mechanisms established by the commodity RATs."
  ],
  "what_to_avoid": [
    "Do not dismiss an infection as 'just' commodity malware (like njRAT); if the target is a government or defense contractor, it may be a targeted Gorgon Group espionage operation.",
    "Avoid relying solely on IP blocking, as Gorgon frequently utilizes compromised legitimate infrastructure and dynamic DNS."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}