- Category
- State · Attributed to a state or working for one.
- Origin
- Pakistan(medium confidence)
- Sponsor
- State-sponsored
- Motivation
- Information theft and espionage
- Seen
- 2017–2026
- Status
- Active
- ATT&CK
- G0078 · 16 techniques
- Sources
- 7 sources carry it
- Identifier
- GINC-APT-0206 · gorgon-group
PakistanWhat it is
Gorgon Group is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. The group has performed a mix of criminal and targeted attacks, including campaigns against government organizations in the United Kingdom, Spain, Russia, and the United States.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- MITRE ATT&CK
- G0078
- Thales
- ATK92
- Other names
- The Gorgon Group, ATK 92, Pasty Draco, Pasty Gemini, Subaat, TAG-CR5
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTPakistan
Targets
- Countries
- Russia, Spain, Switzerland, United Kingdom, United States
- Sectors
- Government, Manufacturing
Tools
The tools and malware families the sources tie to it.
- Archelaus Beta
- Epic
- NanoCore
- QuasarRAT
- Remcos
- njRAT
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de