Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · NEODYMIUM · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06

NEODYMIUM

  • G0055

MITRE G0055 ↗

sigil · no ATT&CK coverage stated

Analyst brief

misp-galaxy + mitre-attack

NEODYMIUM is an activity group that is known to use a backdoor malware detected by Microsoft as Wingbird. This backdoor’s characteristics closely match FinFisher, a government-grade commercial surveillance package. Data about Wingbird activity indicate that it is typically used to attack individual computers instead of networks.

Arsenal

1 malware
Malware
Malware · 1ATT&CK
WingbirdS0176 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs NEODYMIUM is cited as exploiting

none on KEV
  1. CVE-2016-41172026-10-17
    1. “NEODYMIUM also used the exact same CVE-2016-4117 exploit code that PROMETHIUM used, prior to public knowledge of the vulnerability’s existence.”

      cited as exploiting · source: download.microsoft.com ↗ · 2026-10-17

    2. “In early May 2016, both PROMETHIUM and NEODYMIUM started conducting attack campaigns against specific individuals in Europe. They both used an exploit for CVE-2016-4117 , a vulnerability in Adobe Flash Player that, at the time, was both unknown and unpatched.”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

    3. “In early May 2016, both PROMETHIUM and NEODYMIUM started conducting attack campaigns against specific individuals in Europe. They both used an exploit for CVE-2016-4117 , a vulnerability in Adobe Flash Player that, at the time, was both unknown and unpatched.”

      cited as exploiting · source: blogs.technet.microsoft.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2016PROMETHIUM and NEODYMIUM: Parallel zero-day attacks targeting individuals in EuropeMicrosoft ↗

Take it with you

keyless · no signup

References

5 sources
  1. 1.blogs.technet.microsoft.com/mmpc/2016/12/14/twin-zero-day-attacks-promethium-and-n…
  2. 2.attack.mitre.org/groups/G0055
  3. 3.attack.mitre.org/groups/G0055
  4. 4.download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Mi…
  5. 5.cyberscoop.com/middle-eastern-hacking-group-using-finfisher-malware-c…

Track NEODYMIUM on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.