Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.^[1]

Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.^[1]

Gorgon Group malware can use PowerShell commands to download and execute a payload and open a decoy document on the victim’s machine.^[1]

Gorgon Group malware can use cmd.exe to download and execute payloads and to execute commands on the system.^[1]

Gorgon Group has used macros in Spearphishing Attachments as well as executed VBScripts on victim machines.^[1]

Gorgon Group malware can decode contents from a payload that was Base64 encoded and write the contents to a file.^[1]

Gorgon Group malware can attempt to disable security features in Microsoft Office and Windows Defender using the taskkill command.^[1]

Gorgon Group has used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden. ^[1]

Gorgon Group malware can download additional files from C2 servers.^[1]

Gorgon Group malware can deactivate security mechanisms in Microsoft Office by editing several keys and values under HKCU\Software\Microsoft\Office\.^[1]

Gorgon Group malware can leverage the Windows API call, CreateProcessA(), for execution.^[1]

Gorgon Group has obtained and used tools such as QuasarRAT and Remcos.^[1]

Gorgon Group sent emails to victims with malicious Microsoft Office documents attached.^[1]

Gorgon Group malware can download a remote access tool, ShiftyBug, and inject into another process.^[1]

Gorgon Group malware can use process hollowing to inject one of its trojans into another process.^[1]

Gorgon Group attempted to get users to launch malicious Microsoft Office attachments delivered via spearphishing emails.^[1]