The Gorgon Group: Slithering Between Nation State and Cybercrime

Unit 42 analyzes Gorgon Group, a threat actor whose operations span targeted nation-state campaigns and criminal cybercrime, leveraging shared infrastructure, phishing, and multiple malware families (NjRAT, LokiBot, RemcosRAT, NanoCore) to attack governmental and global targets. The group uses macro-delivery documents, Bitly-based C2 domains, and a mix of open-source downloader tools and embedded payloads, with evidence pointing to a Pakistan nexus and active, ongoing activity in 2018.