Gorgon Group

Gorgon Group is a tracked threat actor referred to in the provided content as Gorgon Group. The content associates the group with spearphishing-based delivery using malicious Microsoft Office attachments and attempts to induce user execution of those attachments. Observed tradecraft includes PowerShell execution, including use of the WindowStyle hidden parameter (-W Hidden) to conceal PowerShell windows; use of PowerShell to download and execute payloads and open decoy documents; and use of cmd.exe to download and execute payloads and run commands on victim systems. The group's malware can decode Base64-encoded payload content and write the decoded content to disk. For persistence, the malware can create .lnk files and add Registry Run keys. For defense evasion, the malware can attempt to disable security features in Microsoft Office and Windows Defender using taskkill, and can deactivate Microsoft Office security mechanisms by modifying keys and values under HKCU\Software\Microsoft\Office. The content also states that Gorgon Group has obtained and used tools such as QuasarRAT and Remcos. No nation-state attribution is stated in the provided content.