Home / Threat actors / PROMETHIUM
PROMETHIUM G0056
Also known as: StrongPity
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
0
associated CVEs
18
Techniques
2
Malware and tools
PROMETHIUM is an activity group focused on espionage that has been active since at least 2012. The group has conducted operations globally with a heavy emphasis on Turkish targets. PROMETHIUM has demonstrated similarity to another activity group called NEODYMIUM due to overlapping victim and campaign characteristics.
Exploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
ATT&CK does not cite CVEs for this group.
Techniques by tactic
Resource Development
T1587.002 Code Signing CertificatesT1587.003 Digital Certificates Initial Access
T1078.003 Local AccountsT1189 Drive-by Compromise Execution
T1204.002 Malicious File Persistence
T1078.003 Local AccountsT1205.001 Port KnockingT1543.003 Windows ServiceT1547.001 Registry Run Keys / Startup Folder Privilege Escalation
T1078.003 Local AccountsT1543.003 Windows ServiceT1547.001 Registry Run Keys / Startup Folder Stealth
T1036.004 Masquerade Task or ServiceT1036.005 Match Legitimate Resource Name or LocationT1078.003 Local AccountsT1205.001 Port Knocking Defense Impairment
T1553.002 Code Signing Command and Control
T1205.001 Port Knocking Malware and tools
- StrongPityMalwareS0491
- TruvasysMalwareS0178
© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.