threat actor

PROMETHIUM

unknownentity:threat_actor

PROMETHIUM is an activity group that has been active as early as 2012. The group primarily uses Truvasys, a first-stage malware that has been in circulation for several years. Truvasys has been involved in several attack campaigns, where it has masqueraded as one of server common computer utilities, including WinUtils, TrueCrypt, WinRAR, or SanDisk. In each of the campaigns, Truvasys malware evolved with additional features—this shows a close relationship between the activity groups behind the

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: promethium
kind: threat actor
status: unknown
aliases: APT-C-41 · G0056 · StrongPity
jurisdictions: —
claims naming it: 0 · 0 attributions · 2 relations · 0 events

Identifiers

attack G0056via mitre-attack
misp-galaxy 43894e2a-174e-4931-94a8-2296afe8f650via misp-galaxy-threat-actor

Relations

MITRE ATT&CK Enterpriserecords thatPROMETHIUMusesTruvasys
fetch —sha256 dc1639caa5501d72
rel_611btcintel:relations:611@v1 sha256:4228cbd506c44424
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatPROMETHIUMusesStrongPity
fetch —sha256 dc1639caa5501d72
rel_612btcintel:relations:612@v1 sha256:78499e0a4f041d82
confidenceauthority data · 60

Events

computedno dated events recorded for this entity

Claims naming this entity

computedno current claim names this entity

Subjects0 subjects carry a claim naming this entity · a sample

computedno subject carries a claim naming this entity

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.