Poseidon Group

Overview

Poseidon Group is a Portuguese-speaking threat group that has been active since at least 2005. The group has a history of using information exfiltrated from victims to blackmail victim companies into contracting the Poseidon Group as a security firm.

Naming & attribution

Poseidon Group is tracked under 1 names across the industry. It uses 8 documented ATT&CK techniques — more than 24% of the 174 groups tracked here. Activity attributed since at least 2005.

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• admin@338 China — 4 shared techniques (25% overlap)
• APT1 China — 5 shared techniques (19% overlap)
• ToddyCat — 5 shared techniques (18% overlap)
• Ke3chang China — 6 shared techniques (13% overlap)
• Chimera China — 7 shared techniques (12% overlap)
• APT5 China — 4 shared techniques (12% overlap)

TTPs — 8 techniques across 4 tactics

Reporting (1)

• Poseidon Group: a Targeted Attack Boutique specializing in global cyber-espionage — Kaspersky Lab's Global Research and Analysis Team