Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

The Gorgon Group: Slithering Between Nation State and Cybercrime

Summary: Unit 42 researchers have tracked an attacker called Subaat since 2017 and now tie that actor to a larger crew they call Gorgon Group, which ran a campaign starting in February 2018 against government organizations in the United Kingdom, Spain, Russia, and the United States. The group used shared infrastructure for both targeted attacks and criminal operations, including Bitly and t2m[.]io URL shorteners, OLE2Link objects, and Word documents exploiting CVE-2017-0199, with criminal activity netting 132,840 Bitly clicks from mid-February onward.

Key Takeaway: One domain, stevemike-fireforce[.]info, carried more than 2,300 crimeware emails and 19 documents while also serving targeted attacks on nation-state agencies in the same April-to-May 2018 window, so infrastructure your team dismisses as commodity malspam may be the same infrastructure aimed at government targets.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related