H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Group

Gorgon Group

[Gorgon Group](https://attack.mitre.org/groups/G0078) is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. The group has performed a mix of criminal and targeted attacks, including campaigns against government organizations in the United Kingdom, Spain, Russia, and the United States. (Citation: Unit 42 Gorgon Group Aug 2018)

Group
TypeGroup
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Gorgon Group](https://attack.mitre.org/groups/G0078) is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. The group has performed a mix of criminal and targeted attacks, including campaigns against government organizations in the United Kingdom, Spain, Russia, and the United States. (Citation: Unit 42 Gorgon Group Aug 2018)

20 recorded

Relationships

uses
to Deobfuscate/Decode Files or Information
Technique
uses
to Disable or Modify Tools
Technique
uses
to Hidden Window
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Malicious File
Technique
uses
to Modify Registry
Technique
uses
to NanoCore
Malware
uses
to Native API
Technique
uses
to njRAT
Malware
uses
to Portable Executable Injection
Technique
uses
to PowerShell
Technique
uses
to Process Hollowing
Technique
uses
to QuasarRAT
Tool
uses
to Registry Run Keys / Startup Folder
Technique
uses
to Remcos
Tool
uses
to Shortcut Modification
Technique
uses
to Spearphishing Attachment
Technique
uses
to Tool
Technique
uses
to Visual Basic
Technique
uses
to Windows Command Shell
Technique
3 external

References

mitre-attack
G0078
open
Gorgon Group
—
Unit 42 Gorgon Group Aug 2018
https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance