SYMBOLCOMMON_NAMEaka. SYNONYMS

Group5  (Back to overview)


A threat actor using Iranian-language tools, Iranian hosting companies, operating from the Iranian IP space at times was observed targeting the Syrian opposition in an elaborately staged malware operation, Citizen Lab researchers reveal. The operation was first noticed in late 2015, when a member of the Syrian opposition flagged a suspicious email containing a PowerPoint slideshow, which led researchers to a watering hole website with malicious programs, malicious PowerPoint files, and Android malware. The threat actor was targeting Windows and Android devices of well-connected individuals in the Syrian opposition, researchers discovered. They called the actor Group5, because it targets Syrian opposition after regime-linked malware groups, the Syrian Electronic Army, ISIS (also known as the Islamic State or ISIL), and a group linked to Lebanon did the same in the past


Associated Families

There are currently no families associated with this actor.


References
2019MITREMITRE ATT&CK
@online{attck:2019:group5:fcdeaa8, author = {MITRE ATT&CK}, title = {{Group description: Group5}}, date = {2019}, organization = {MITRE}, url = {https://attack.mitre.org/groups/G0043/}, language = {English}, urldate = {2019-12-20} } Group description: Group5
Group5
2016-08-04SecurityWeekSecurityWeek News
@online{news:20160804:iranian:5f8a693, author = {SecurityWeek News}, title = {{Iranian Actor "Group5" Targeting Syrian Opposition}}, date = {2016-08-04}, organization = {SecurityWeek}, url = {https://www.securityweek.com/iranian-actor-group5-targeting-syrian-opposition}, language = {English}, urldate = {2019-12-17} } Iranian Actor "Group5" Targeting Syrian Opposition
Group5

Credits: MISP Project