The Gorgon Group — APT Profile

Gorgon Group is the name Palo Alto Networks Unit 42 gave to a Pakistan-linked crew it surfaced while following an actor using the handle Subaat, tracked since 2017 and later assessed to be one of at least five operators whose online personas placed them in Pakistan; earlier technical work by 360 and Tuisec had drawn similar Pakistani threads, which Unit 42 folded into its own analysis. What set the crew apart was that it never separated espionage from profit: Unit 42 found a single domain, stevemike-fireforce[.]info, pushing more than 2,300 malspam messages between April and May 2018 while on the same dates serving spear-phishing aimed at government bodies in Russia, Spain, the United Kingdom and the United States. Delivery leaned on Microsoft Word lures built around CVE-2017-0199 and OLE2Link objects hidden behind Bitly and t2m[.]io short links, with commodity remote-access trojans — NanoCore, njRAT, QuasarRAT, RevengeRAT and Remcos — plus the LokiBot infostealer as payloads. ETDA's threat-group encyclopedia additionally logs a July 2017 phishing run against US government targets that used an older RTF flaw, CVE-2012-0158, to drop QuasarRAT, and campaigns against Indian small-business and manufacturing firms in April and July 2020. The same encyclopedia records suspected overlap with Transparent Tribe and with the Aggah activity cluster, so Gorgon is better read as one node in a broader Pakistani ecosystem than as a self-contained team.

Tools & malware

Vendor research

Read the full analysis on IntelFusions