GorillaThreat actor
Gorilla is a threat-actor operating a DoS-as-a-service service controlled on Telegram.From MISP Galaxy
Last reported 12 days ago, by SOCRadar2 reports
ATT&CK techniques
6 of 38 · each with the sentence it comes from- T1005Data from Local System
“T1005”
- T1033System Owner/User Discovery
“T1033”
- T1036Masquerading
“Masquerading: Match Legitimate Resource Name or Location”
- T1036.005Match Legitimate Resource Name or Location
“T1036.005”
- T1048Exfiltration Over Alternative Protocol
“Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol”
- T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
“T1048.002”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Inside ICMacOS: From an Infostealer to a Persistent RAT“Real-Time Interactive C2 (Gorilla WebSocket)”
-
TransparentTribe Targets Indian Military with DeskRAT Malware“After calling again some fodder function, EstablishConnection() will establish communication with the C2 leveraging the Gorilla WebSocket library.”
Indicators in its reports
named in the reports above- exploit[.]inin 1 report
- hxxps://ipinfo[.]io/countryin 1 report
- 4c56fedd177108a8849cec423f020625in 1 report
- hxxps://modgovindia[.]com/download.php?file=Gimpfile.txtin 1 report
- modgovindia[.]comin 1 report
- hxxps://modgovindia[.]com/CDS_Directive_Armed_Forces.pdfin 1 report
- hxxps://modgovindia[.]com/CDSin 1 report
- 3563518ef8389c7c7ac2a80984a2c4cdin 1 report
- 147.93.155[.]118in 1 report
- newforsomething[.]restin 1 report
- hxxp://seeconnectionalive[.]website:8080/loginin 1 report
- seeconnectionalive[.]websitein 1 report
Copy these 12 indicators · defanged
Thanks — we review every report.