Gorgon Group
IntrusionSet · ATTACK:enterprise:G0078
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0078",
"title": "Gorgon Group",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0078",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--1f21da59-6a13-455b-afd0-d58d0a5a7d27",
"external_id": "G0078",
"domain": "enterprise",
"created": "2018-10-17T00:14:20.652Z",
"modified": "2026-07-31T18:47:42.035Z",
"version": "1.5",
"aliases": [
"Gorgon Group"
],
"tactics": [
],
"source_references": [
{
"source_name": "Gorgon Group"
},
{
"source_name": "Unit 42 Gorgon Group Aug 2018",
"url": "https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/"
}
]
}Explicit source assertions (20)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0078 → uses → ATTACK:enterprise:T1055.012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--07e8c425-2d17-48ea-98ca-40a2aac8cc10
Unit 42 Gorgon Group Aug 2018ATTACK:enterprise:G0078 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0b926b38-f00a-4ea2-a64b-8b4c05851629
Unit 42 Gorgon Group Aug 2018ATTACK:enterprise:G0078 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1b1e5d59-20a4-4915-a553-4db606d8121d
Unit 42 Gorgon Group Aug 2018ATTACK:enterprise:G0078 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--304c0297-8d9e-41ee-a5c0-f8bd33bdcd2a
Unit 42 Gorgon Group Aug 2018ATTACK:enterprise:G0078 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--313082d2-c493-4053-80c1-06300aeea8e0
Unit 42 Gorgon Group Aug 2018ATTACK:enterprise:G0078 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3ed930d6-ab79-4642-8320-2ed59d899b6d
Unit 42 Gorgon Group Aug 2018ATTACK:enterprise:G0078 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5096cf5d-aedb-49a5-baa7-4cc9538fa1cd
Unit 42 Gorgon Group Aug 2018ATTACK:enterprise:G0078 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5f73d53f-f543-47b6-ab81-9a2764dabaef
Unit 42 Gorgon Group Aug 2018ATTACK:enterprise:G0078 → uses → ATTACK:enterprise:S0336
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6dfdfcc8-ff89-4991-830a-5ca31f43b251
Unit 42 Gorgon Group Aug 2018ATTACK:enterprise:G0078 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7a2f70b7-7b6e-4c05-8f71-42a494b055ce
Unit 42 Gorgon Group Aug 2018ATTACK:enterprise:G0078 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--85a1a7f3-bdcc-4473-ba3c-46d6946d6996
Unit 42 Gorgon Group Aug 2018ATTACK:enterprise:G0078 → uses → ATTACK:enterprise:T1055.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--88078d5c-bbc9-4c34-858f-e18d472d38d4
Unit 42 Gorgon Group Aug 2018ATTACK:enterprise:G0078 → uses → ATTACK:enterprise:S0262
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9839e4e4-06c2-4f6a-8fe0-bc556e547536
Unit 42 Gorgon Group Aug 2018ATTACK:enterprise:G0078 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9f00ebba-7e80-4495-8ba0-081e6a8cc0c8
Unit 42 Gorgon Group Aug 2018ATTACK:enterprise:G0078 → uses → ATTACK:enterprise:T1547.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a1ec1602-33d6-45be-8eda-2020094e93a4
Unit 42 Gorgon Group Aug 2018ATTACK:enterprise:G0078 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aee59ac6-e6e6-4b35-b2ce-4e529d4efc4b
Unit 42 Gorgon Group Aug 2018ATTACK:enterprise:G0078 → uses → ATTACK:enterprise:S0332
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bfe45239-7fa4-45a5-bb47-86c4ae46906c
Unit 42 Gorgon Group Aug 2018ATTACK:enterprise:G0078 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c298538c-bab6-4982-9b83-17f752358932
Unit 42 Gorgon Group Aug 2018ATTACK:enterprise:G0078 → uses → ATTACK:enterprise:S0385
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c3dd85c9-407c-4718-ba17-3c377c544dde
Unit 42 Gorgon Group Aug 2018ATTACK:enterprise:G0078 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f623affb-f6e8-4c32-a44f-8835fff92c59
Unit 42 Gorgon Group Aug 2018