Group5
Group5 is an Iran-attributed cybercrime syndicate with an espionage motive, tracked by Brandefense. It targets 12 sectors, including Government and Technology, in 4 countries, including the United States and Israel. It uses 8 MITRE ATT&CK techniques and exploits 1 known CVE.
- G0043
- Origin
- Iran
- Techniques
- 8
- Exploited CVEs
- 1
- First seen
- Oct 3, 2015
- Record updated
Who They Target.
About Group5.
Group5 is a threat group with a suspected Iranian nexus, though this attribution is not definite. The group has targeted individuals connected to the Syrian opposition via spearphishing and watering holes, normally using Syrian and Iranian themes. Group5 has used two commonly available remote access tools (RATs), njRAT and NanoCore, as well as an Android RAT, DroidJack.
Last updated Sep 30, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.