Group5

Linked to Iran by one source.

Reports: 2
Last reported: 6 April 2026
Known CVEs: 1
Techniques in ATT&CK: 4
Origin: Iran

ID: G0043
Sources: ATT&CK MISP ETDA Malpedia
Merge evidence: 5 alias matches

Reports per quarter

2016 Q3: 1 report
2016 Q4: no reports
2017 Q1: no reports
2017 Q2: no reports
2017 Q3: no reports
2017 Q4: no reports
2018 Q1: no reports
2018 Q2: no reports
2018 Q3: no reports
2018 Q4: no reports
2019 Q1: no reports
2019 Q2: no reports
2019 Q3: no reports
2019 Q4: no reports
2020 Q1: no reports
2020 Q2: no reports
2020 Q3: no reports
2020 Q4: no reports
2021 Q1: no reports
2021 Q2: no reports
2021 Q3: no reports
2021 Q4: no reports
2022 Q1: no reports
2022 Q2: no reports
2022 Q3: no reports
2022 Q4: no reports
2023 Q1: no reports
2023 Q2: no reports
2023 Q3: no reports
2023 Q4: no reports
2024 Q1: no reports
2024 Q2: no reports
2024 Q3: no reports
2024 Q4: no reports
2025 Q1: no reports
2025 Q2: no reports
2025 Q3: no reports
2025 Q4: no reports
2026 Q1: no reports
2026 Q2: 1 report

Dated reports, 2016 Q3 to 2026 Q2.

Techniques in ATT&CK

Listed by ATT&CK

No report from the last two years names a technique ID.

CVEs named in reports

CVE-2014-4114 KEV

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

6 April 2026

Group5: Syria and the Iranian Connection - The Citizen Lab

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Group5: Syria and the Iranian Connection - The Citizen Lab
2 August 2016

Group5_ Syria and the Iranian Connection - The Citizen Lab

date in the CCS '25 data Citizen Lab fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Group5_ Syria and the Iranian Connection - The Citizen Lab

Newest first. Details opens the report in Explore.