Home / Threat actors / Group5
Group5 G0043
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
0
associated CVEs
5
Techniques
2
Malware and tools
Group5 is a threat group with a suspected Iranian nexus, though this attribution is not definite. The group has targeted individuals connected to the Syrian opposition via spearphishing and watering holes, normally using Syrian and Iranian themes. Group5 has used two commonly available remote access tools (RATs), njRAT and NanoCore, as well as an Android RAT, DroidJack.
Exploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
ATT&CK does not cite CVEs for this group.
Techniques by tactic
Stealth
T1027.013 Encrypted/Encoded FileT1070.004 File Deletion Credential Access
T1056.001 Keylogging Collection
T1056.001 KeyloggingT1113 Screen Capture © The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.