For the past year and a half, we have been tracking a group known as the ‘Gorgon Group’. This particular group of criminals is unique in particular due to their desires to not only conduct targeted attacks against foreign governments, but also to perform large scale commodity attacks to earn a profit. This talk will discuss how the initial discover of the Gorgon Group was made, and how a single attack led us to discovering that this group was much, much larger than we originally thought. We’ll discuss the group’s malware, tactics, motivations, and (speaking gods willing) attribution.