- Category
- State · Attributed to a state or working for one.
- Origin
- Iran(high confidence)
- Sponsor
- State-sponsored
- Motivation
- Information theft and espionage
- Seen
- 2015–2026
- Status
- Active
- ATT&CK
- G0043 · 4 techniques
- Sources
- 9 sources carry it
- Identifier
- GINC-APT-0090 · group5
IranWhat it is
Group5 is a threat group with a suspected Iranian nexus, though this attribution is not definite. The group has targeted individuals connected to the Syrian opposition via spearphishing and watering holes, normally using Syrian and Iranian themes. Group5 has used two commonly available remote access tools (RATs), njRAT and NanoCore, as well as an Android RAT, DroidJack.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- MITRE ATT&CK
- G0043
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTIran
- ThreatActor.info (Malpedia et al.)Iran · high
Targets
- Countries
- Syria
Tools
The tools and malware families the sources tie to it.
- Androrat
- Archelaus Beta
- DroidJack
- NanoCore
- NanoCore RAT
- POWERSOURCE
- POWERSTATS
- Power Loader
- PowerDuke
- PowerRAT
- SPACESHIP
- Windows Remote Desktop
- njRAT
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de