PROMETHIUM - G0056

Created: 2018-01-16T16:13:52.465Z

Modified: 2020-10-22T18:12:48.893Z

Contributors:

Aliases

PROMETHIUM,StrongPity

Description

PROMETHIUM is an activity group focused on espionage that has been active since at least 2012. The group has conducted operations globally with a heavy emphasis on Turkish targets. PROMETHIUM has demonstrated similarity to another activity group called NEODYMIUM due to overlapping victim and campaign characteristics.(Citation: Microsoft NEODYMIUM Dec 2016)(Citation: Microsoft SIR Vol 21)(Citation: Talos Promethium June 2020)

Techniques Used

PROMETHIUM has created self-signed certificates to sign malicious installers.(Citation: Bitdefender StrongPity June 2020)|
|mitre-attack|enterprise-attack|PRE|T1587.003|Digital Certificates|

PROMETHIUM has created self-signed digital certificates for use in HTTPS C2 traffic.(Citation: Talos Promethium June 2020)|
|mitre-attack|enterprise-attack|Windows|T1543.003|Windows Service|

PROMETHIUM has created new services and modified existing services for persistence.(Citation: Bitdefender StrongPity June 2020)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1036.004|Masquerade Task or Service|

PROMETHIUM has named services to appear legitimate.(Citation: Talos Promethium June 2020)(Citation: Bitdefender StrongPity June 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1078.003|Local Accounts|

PROMETHIUM has created admin accounts on a compromised host.(Citation: Bitdefender StrongPity June 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1205.001|Port Knocking|