Unit 42 Gorgon Group Aug 2018

Gorgon Group malware can download a remote access tool, ShiftyBug, and inject into another process.

Gorgon Group malware can use process hollowing to inject one of its trojans into another process.

Gorgon Group malware can use PowerShell commands to download and execute a payload and open a decoy document on the victim’s machine.

Gorgon Group malware can use cmd.exe to download and execute payloads and to execute commands on the system.

Gorgon Group has used macros in Spearphishing Attachments as well as executed VBScripts on victim machines.

Gorgon Group malware can download additional files from C2 servers.

Gorgon Group malware can leverage the Windows API call, CreateProcessA(), for execution.

Gorgon Group malware can deactivate security mechanisms in Microsoft Office by editing several keys and values under HKCU\Software\Microsoft\Office\.

Gorgon Group malware can decode contents from a payload that was Base64 encoded and write the contents to a file.

Gorgon Group attempted to get users to launch malicious Microsoft Office attachments delivered via spearphishing emails.

Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.

Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.

Gorgon Group has used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.

Gorgon Group sent emails to victims with malicious Microsoft Office documents attached.

Gorgon Group has obtained and used tools such as QuasarRAT and Remcos.

Gorgon Group malware can attempt to disable security features in Microsoft Office and Windows Defender using the taskkill command.