Unit 42 researchers have been tracking Subaat, an attacker, since 2017. Recently Subaat drew our attention due to renewed targeted attack activity. Part of monitoring Subaat included realizing the actor was possibly part of a larger crew of individuals responsible for carrying out targeted attacks against worldwide governmental organizations. Technical analysis on some of the attacks as well as attribution links with Pakistan actors have been already depicted by 360 and Tuisec, in which they found interesting connections to a larger group of attackers Unit 42 researchers have been tracking, which we are calling Gorgon Group.
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| OSINT | Gorgon Group |
| OSINT | Subaat |
| OSINT | ATK92 |
| OSINT | G0078 |
| OSINT | Pasty Gemini |
No IOCs extracted yet from reports naming this actor.
Every report in the Global Intel Library that names The Gorgon Group, newest first. Open any report to see the full analysis with provenance.
No reports in the Lore library name this actor yet.
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to The Gorgon Group. Each row shows why it was linked and where it came from.
No feed indicators linked to this actor yet. Feeds are checked every hour.
Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.