Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · PROMETHIUM · Unknown · assessed origin Türkiye · misp-galaxy + mitre-attack · refreshed 2026-10-06

PROMETHIUM

  • StrongPity
  • G0056
  • APT-C-41

MITRE G0056 ↗

PROMETHIUM — ATT&CK rosePR

attack rose · 11 techniques across 6 tactics

What changed

ledger · newest first
  1. —todaynew CVE1 new CVE: CVE-2016-4117

Analyst brief

misp-galaxy + mitre-attack

PROMETHIUM is an activity group that has been active as early as 2012. The group primarily uses Truvasys, a first-stage malware that has been in circulation for several years. Truvasys has been involved in several attack campaigns, where it has masqueraded as one of server common computer utilities, including WinUtils, TrueCrypt, WinRAR, or SanDisk. In each of the campaigns, Truvasys malware evolved with additional features—this shows a close relationship between the activity groups behind the campaigns and the developers of the malware.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

11 techniques · 6 of 15 tactics

  1. Resource development

    2 techniques

  2. Initial access

    1 technique

  3. Execution

    1 technique

  4. Persistence

    2 techniques

  5. Stealth

    4 techniques

  6. Defense impairment

    1 technique

select a technique

Arsenal

2 malware
Malware
Malware · 2ATT&CK
TruvasysS0178 ↗
StrongPityS0491 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs PROMETHIUM is cited as exploiting

none on KEV
  1. CVE-2016-41172026-10-17
    1. “In early May 2016, both PROMETHIUM and NEODYMIUM started conducting attack campaigns against specific individuals in Europe. They both used an exploit for CVE-2016-4117 , a vulnerability in Adobe Flash Player that, at the time, was both unknown and unpatched.”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

    2. “In early May 2016, both PROMETHIUM and NEODYMIUM started conducting attack campaigns against specific individuals in Europe. They both used an exploit for CVE-2016-4117 , a vulnerability in Adobe Flash Player that, at the time, was both unknown and unpatched.”

      cited as exploiting · source: blogs.technet.microsoft.com ↗ · 2026-10-17

    3. “In 2016, an attack campaign by this group was recorded in early May that made use of an exploit for CVE-2016-4117, a vulnerability in Adobe Flash Player, which at the time was both unknown and unpatched.”

      cited as exploiting · named nearby · source: download.microsoft.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2016On the StrongPity Waterhole Attacks Targeting Italian and Belgian Encryption UsersKaspersky ↗
  2. 2016PROMETHIUM and NEODYMIUM: Parallel zero-day attacks targeting individuals in EuropeMicrosoft ↗

Take it with you

keyless · no signup

References

8 sources
  1. 1.microsoft.com/security/blog/2016/12/14/twin-zero-day-attacks-prometh…
  2. 2.virusbulletin.com/conference/vb2016/abstracts/last-minute-paper-strongpi…
  3. 3.attack.mitre.org/groups/G0056
  4. 4.attack.mitre.org/groups/G0056
  5. 5.download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Mi…
  6. 6.blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html
  7. 7.blogs.technet.microsoft.com/mmpc/2016/12/14/twin-zero-day-attacks-promethium-and-n…
  8. 8.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepape…

Track PROMETHIUM on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.