PROMETHIUM

Overview

PROMETHIUM is an activity group focused on espionage that has been active since at least 2012. The group has conducted operations globally with a heavy emphasis on Turkish targets. PROMETHIUM has demonstrated similarity to another activity group called NEODYMIUM due to overlapping victim and campaign characteristics.

Naming & attribution

PROMETHIUM is tracked under 2 names across the industry. It uses 11 documented ATT&CK techniques — more than 32% of the 174 groups tracked here. Activity attributed since at least 2012.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

• T1205.001 Port Knocking — used by 2 of 174 groups
• T1587.002 Code Signing Certificates — used by 3 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• RTM Russia — 3 shared techniques (20% overlap)
• Naikon China — 4 shared techniques (19% overlap)
• Carbanak — 3 shared techniques (18% overlap)
• Darkhotel South Korea — 5 shared techniques (17% overlap)
• Machete — 3 shared techniques (16% overlap)
• Dark Caracal — 3 shared techniques (15% overlap)

TTPs — 11 techniques across 6 tactics

Tools & malware (2)

Truvasys · StrongPity

Reporting (3)

• StrongPity APT - Revealing Trojanized Tools, Working Hours and Infrastructure — Tudorica, R. et al
• PROMETHIUM extends global reach with StrongPity3 APT — Mercer, W. et al
• Microsoft Security Intelligence Report Volume 21 — Anthe, C. et al