{
  "family": "gorgon",
  "sample_count": 13,
  "category": "apt",
  "description": "Gorgon (tracked in threat intelligence as The Gorgon Group, Backdoor:Win32/Gorgon, and Trojan:Win32/Gorgon) is a cyber espionage and targeted crimeware toolset linked to a suspected Pakistani threat actor group operating since 2018. Gorgon campaigns conduct spear-phishing attacks against governmental, military, and diplomatic entities in the UK, Spain, Russia, and the United States, as well as private sector enterprises. The group utilizes weaponized Microsoft Office documents containing CVE-2017-0199 or CVE-2017-11882 exploits to deliver multi-stage VBScript, PowerShell, and AutoIt loaders. Once executed, Gorgon payloads drop commercial and custom remote access trojans (including njRAT, Remcos, and custom backdoors) to establish persistent C2 access, conduct surveillance, and steal sensitive diplomatic and corporate files.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Gorgon",
    "Backdoor:Win32/Gorgon",
    "The Gorgon Group",
    "Gorgon APT",
    "Win32/Gorgon"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Gorgon (The Gorgon Group)?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The Gorgon Group is an advanced persistent threat (APT) actor and malware framework conducting cyber espionage and financial crime."
      }
    },
    {
      "@type": "Question",
      "name": "What targets does the Gorgon Group focus on?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Governmental, diplomatic, and military targets in Europe, the United States, and Asia, alongside financial institutions."
      }
    },
    {
      "@type": "Question",
      "name": "How does Gorgon deliver its malware payloads?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through targeted spear-phishing emails containing weaponized Microsoft Office documents exploiting CVE-2017-0199 or CVE-2017-11882."
      }
    },
    {
      "@type": "Question",
      "name": "What RATs are commonly deployed by Gorgon?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Commercial and commodity RATs including njRAT, Remcos, and custom Python/VBScript backdoors."
      }
    },
    {
      "@type": "Question",
      "name": "How can organizations protect against Gorgon attacks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Patch Microsoft Office vulnerability CVE-2017-11882, block macro execution from external emails, and deploy endpoint behavioral EDR."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.001",
    "T1203",
    "T1059.001",
    "T1059.005",
    "T1547.001",
    "T1071.001",
    "T1041"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1190",
      "name": "Exploit Public-Facing Application (CVE-2017-11882)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1059.001",
      "name": "Command and Scripting Interpreter: PowerShell",
      "tactic": "Execution"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging (via commodity RATs)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Isolate the compromised endpoint; determine if the payload is a generic stealer (criminal track) or a persistent RAT (espionage track).",
    "Identify the initial phishing vector and search enterprise email logs for similar emails to find other potentially compromised users.",
    "Ensure all Microsoft Office installations are fully patched against CVE-2017-11882 and related Equation Editor vulnerabilities, as Gorgon relies heavily on these old exploits.",
    "Audit the endpoint's Registry Run keys and Scheduled Tasks to remove the persistence mechanisms established by the commodity RATs."
  ],
  "what_to_avoid": [
    "Do not dismiss an infection as 'just' commodity malware (like njRAT); if the target is a government or defense contractor, it may be a targeted Gorgon Group espionage operation.",
    "Avoid relying solely on IP blocking, as Gorgon frequently utilizes compromised legitimate infrastructure and dynamic DNS."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Palo Alto Networks Unit 42 - The Gorgon Group Threat Assessment",
      "url": "https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-between-nation-state-and-cybercrime/"
    },
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Gorgon",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Gorgon"
    },
    {
      "name": "MITRE ATT&CK - Exploitation for Client Execution (T1203)",
      "url": "https://attack.mitre.org/techniques/T1203/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}