Forensia CTI Core

Profile

Group5 is a threat group with a suspected Iranian nexus, though this attribution is not definite. The group has targeted individuals connected to the Syrian opposition via spearphishing and watering holes, normally using Syrian and Iranian themes. Group5 has used two commonly available remote access tools (RATs), njRAT and NanoCore, as well as an Android RAT, DroidJack.

MITRE ATT&CK ↗

Techniques

4 ATT&CK techniques attributed to this actor.

T1027.013 Encrypted/Encoded File T1056.001 Keylogging T1070.004 File Deletion T1113 Screen Capture

Software

2 malware/tools attributed to this actor.

NanoCorenjRAT

Related corpus activity

7,021 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to Group5.

Indicator	Type	Family	Sev	Src
cve-2025-7443	cve	—	85	1
cve-2023-44976	cve	ransomware	85	2
cve-2020-22658	cve	—	85	2
cve-2025-34085	cve	—	85	1
cve-2026-3844	cve	—	85	1
cve-2025-2492	cve	—	85	2
cve-2026-22584	cve	—	85	2
cve-2020-22653	cve	—	85	2
cve-2026-1969	cve	—	85	1
cve-2025-12057	cve	—	85	1
cve-2025-23304	cve	—	85	2
cve-2025-7852	cve	—	85	1
cve-2026-0740	cve	—	85	1
cve-2021-29441	cve	—	85	1
cve-2025-66478	cve	—	85	2
cve-2025-0921	cve	—	85	2
cve-2026-3102	cve	—	85	3
5864a697bd7b339f56b05405f29a097cd027cafdcc4e63c2aaeccccbf930605f	sha256	—	80	1
7b7981c99d59595fe15377df84695bb72ce0b85560a3935f930657b2d162e5ef	sha256	phishing	80	1
adcd15f3d6b87f84d106ea426fa824fd20c9d64f6d199ce92580884290785f30	sha256	phishing	80	1
a37f6403fbf28fa0b48863287f4c5a5d	hash	cryptojacking	80	2
6c6cbed6aad96564ed87094785be07a1	hash	phishing	80	2
f4d77958a12a0778283d3e679b24b18f82e332c4	hash	—	80	3
01e3dce00ea45829bd9f6a583004976ac63973a0	hash	cryptojacking	80	1
ad10ff9043d6f327045943635fcbd0c5918acb79dc998db92ee4c7dee5224710	sha256	—	80	1
55d6238b01a177e25eb7d53c943f3abea64ec073	hash	phishing	80	2
4c9f271242f61f1a31b8146305e9a7ed512c521445d4f7a7a901e301307add3d	sha256	—	80	1
61e9d76f07334843df561fe4bac449fb6fdaed5e5eb91480bded225f3d265c5f	hash	phishing	80	2
d7d2f0ee187549f3f4a114d716be12521fbf62d6d26e2ac23d2a32d521d08fd8	sha256	phishing	80	1
579a82dde4425d95e20a22171be0a37702c833fdca6e5e04f69099a025863136	hash	cryptojacking	80	2

Showing the top 30 by severity of 7,021.