PROMETHIUM
BedrohungsakteurTRauch bekannt als
Weitere Namen und Kennungen dieser Entität.
ATT&CK
PROMETHIUM · StrongPity
MISP
APT-C-41 · PROMETHIUM · StrongPity
PROMETHIUM is an activity group that has been active as early as 2012. The group primarily uses Truvasys, a first-stage malware that has been in circulation for several years. Truvasys has been involved in several attack campaigns, where it has masqueraded as one of server common computer utilities, including WinUtils, TrueCrypt, WinRAR, or SanDisk. In each of the campaigns, Truvasys malware evolved with additional features—this shows a close relationship between the activity groups behind the campaigns and the developers of the malware.
zugeordnete ATT&CK-Gruppen
Zugehörige Bedrohungsgruppen.
genutzte Techniken (11)
ATT&CK-Techniken, die dies ermöglicht oder abbildet.
Kampagnen (1)
Kampagnen, die dies verwenden.
genutzte Software (2)
Zugehörige Malware und Tools.
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://www.microsoft.com/security/blog/2016/12/14/twin-zero-day-attacks-promethium-and-neodymium-target-individuals-in-europe/
- https://www.virusbulletin.com/conference/vb2016/abstracts/last-minute-paper-strongpity-waterhole-attacks-targeting-italian-and-belgian-encryption-users
- https://attack.mitre.org/groups/G0056/