MITRE ATT&CKgroup
G0056 PROMETHIUM
- Domain
- enterprise, mobile
- Aliases
- StrongPity
- Version
- 2.1
- Created
- 2018-01-16
Description
PROMETHIUM is an activity group focused on espionage that has been active since at least 2012. The group has conducted operations globally with a heavy emphasis on Turkish targets. PROMETHIUM has demonstrated similarity to another activity group called NEODYMIUM due to overlapping victim and campaign characteristics.
Related
Uses · MITRE ATT&CK (13)
- T1587.002 Code Signing Certificates sub-technique
- T1587.003 Digital Certificates sub-technique
- S0491 StrongPity software (malware)
- T1205.001 Port Knocking sub-technique
- T1078.003 Local Accounts sub-technique
- T1204.002 Malicious File sub-technique
- T1036.004 Masquerade Task or Service sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1553.002 Code Signing sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1543.003 Windows Service sub-technique
- T1189 Drive-by Compromise technique
- S0178 Truvasys software (malware)
Referenced by MITRE ATT&CK · attributed to (1)
- C0033 C0033 campaign
References
- http://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf Microsoft SIR Vol 21
- https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html Talos Promethium June 2020
- https://blogs.technet.microsoft.com/mmpc/2016/12/14/twin-zero-day-attacks-promethium-and-neodymium-target-individuals-in-europe/ Microsoft NEODYMIUM Dec 2016
- https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf Bitdefender StrongPity June 2020