{
  "type": "bundle",
  "id": "bundle--8bed70a4-1fe2-5bc3-9620-87e6be33b3a9",
  "objects": [
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
      "created": "2017-01-20T00:00:00.000Z",
      "definition_type": "tlp",
      "name": "TLP:WHITE",
      "definition": {
        "tlp": "white"
      }
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-09-07T00:00:00.000Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "name": "skopnix",
      "identity_class": "organization",
      "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.",
      "contact_information": "https://skopnix.com"
    },
    {
      "type": "intrusion-set",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "intrusion-set--c19dcd43-2a63-5290-869e-5b342abe563f",
      "name": "PROMETHIUM",
      "aliases": [
        "PROMETHIUM",
        "StrongPity",
        "APT-C-41"
      ],
      "description": "PROMETHIUM is an activity group that has been active as early as 2012. The group primarily uses Truvasys, a first-stage malware that has been in circulation for several years. Truvasys has been involved in several attack campaigns, where it has masqueraded as one of server common computer utilities, including WinUtils, TrueCrypt, WinRAR, or SanDisk. In each of the campaigns, Truvasys malware evolved with additional features—this shows a close relationship between the activity groups behind the campaigns and the developers of the malware.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "G0056",
          "url": "https://attack.mitre.org/groups/G0056/"
        },
        {
          "source_name": "skopnix",
          "external_id": "promethium",
          "url": "https://skopnix.com/actors/promethium"
        },
        {
          "source_name": "microsoft.com",
          "url": "https://www.microsoft.com/security/blog/2016/12/14/twin-zero-day-attacks-promethium-and-neodymium-target-individuals-in-europe/"
        },
        {
          "source_name": "virusbulletin.com",
          "url": "https://www.virusbulletin.com/conference/vb2016/abstracts/last-minute-paper-strongpity-waterhole-attacks-targeting-italian-and-belgian-encryption-users"
        },
        {
          "source_name": "attack.mitre.org",
          "url": "https://attack.mitre.org/groups/G0056"
        },
        {
          "source_name": "download.microsoft.com",
          "url": "http://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf"
        },
        {
          "source_name": "blog.talosintelligence.com",
          "url": "https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html"
        },
        {
          "source_name": "blogs.technet.microsoft.com",
          "url": "https://blogs.technet.microsoft.com/mmpc/2016/12/14/twin-zero-day-attacks-promethium-and-neodymium-target-individuals-in-europe/"
        },
        {
          "source_name": "bitdefender.com",
          "url": "https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--55fe7003-f813-53fc-bef1-edc0eec8a7ed",
      "name": "Code Signing Certificates",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1587.002",
          "url": "https://attack.mitre.org/techniques/T1587/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--be631a8d-2393-51fe-8c1c-4fe84d3992a9",
      "name": "Digital Certificates",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1587.003",
          "url": "https://attack.mitre.org/techniques/T1587/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--a09471aa-93fe-54b1-a009-7912f317e600",
      "name": "Drive-by Compromise",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1189",
          "url": "https://attack.mitre.org/techniques/T1189/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "initial-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--5fca71f8-fdc7-5a29-a449-bae25d7dc890",
      "name": "Malicious File",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1204.002",
          "url": "https://attack.mitre.org/techniques/T1204/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--d6564283-cb2e-5245-962e-31a883b2656c",
      "name": "Windows Service",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1543.003",
          "url": "https://attack.mitre.org/techniques/T1543/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "persistence"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--7f5faf4c-64c8-5ce5-94f8-af8f5cfd82de",
      "name": "Registry Run Keys / Startup Folder",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1547.001",
          "url": "https://attack.mitre.org/techniques/T1547/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "persistence"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--7c173797-2d12-5fd3-9f00-104c2ff30c48",
      "name": "Masquerade Task or Service",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1036.004",
          "url": "https://attack.mitre.org/techniques/T1036/004/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--38c56b01-4c61-5ed2-a4aa-bbc3328c26db",
      "name": "Match Legitimate Resource Name or Location",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1036.005",
          "url": "https://attack.mitre.org/techniques/T1036/005/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--b568d4de-f822-5177-9450-a4bc9bf1c777",
      "name": "Local Accounts",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1078.003",
          "url": "https://attack.mitre.org/techniques/T1078/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--5d73fcda-34f8-53cb-94e7-4c67d2e6ca5d",
      "name": "Port Knocking",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1205.001",
          "url": "https://attack.mitre.org/techniques/T1205/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--352754b6-8cf8-5992-910a-11525df9d710",
      "name": "Code Signing",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1553.002",
          "url": "https://attack.mitre.org/techniques/T1553/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-impairment"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--a2cd4475-7739-5688-a0ee-8f7b2d161c31",
      "name": "Truvasys",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0178",
          "url": "https://attack.mitre.org/software/S0178/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--66a63980-d32a-5e01-9dd2-f4c23b42f034",
      "name": "StrongPity",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0491",
          "url": "https://attack.mitre.org/software/S0491/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--6d001d1f-95a3-508b-a8f0-180e66664f04",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--c19dcd43-2a63-5290-869e-5b342abe563f",
      "target_ref": "attack-pattern--55fe7003-f813-53fc-bef1-edc0eec8a7ed"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--4569ec80-4e8b-5249-a30c-7d4f24f22a1d",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--c19dcd43-2a63-5290-869e-5b342abe563f",
      "target_ref": "attack-pattern--be631a8d-2393-51fe-8c1c-4fe84d3992a9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--6d3aeea8-3535-540e-8d51-cca07b114f9a",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--c19dcd43-2a63-5290-869e-5b342abe563f",
      "target_ref": "attack-pattern--a09471aa-93fe-54b1-a009-7912f317e600"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--1f388897-ff25-5477-99c5-db4e8e2109ab",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--c19dcd43-2a63-5290-869e-5b342abe563f",
      "target_ref": "attack-pattern--5fca71f8-fdc7-5a29-a449-bae25d7dc890"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--3d04ff52-8a61-5577-979e-5a2e2a512a02",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--c19dcd43-2a63-5290-869e-5b342abe563f",
      "target_ref": "attack-pattern--d6564283-cb2e-5245-962e-31a883b2656c"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--73055fe4-7d98-57fd-9743-a3faefe67378",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--c19dcd43-2a63-5290-869e-5b342abe563f",
      "target_ref": "attack-pattern--7f5faf4c-64c8-5ce5-94f8-af8f5cfd82de"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--8b8eae8f-a3d1-5420-90ac-707a6c90e5fc",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--c19dcd43-2a63-5290-869e-5b342abe563f",
      "target_ref": "attack-pattern--7c173797-2d12-5fd3-9f00-104c2ff30c48"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--16fb34d4-388f-592c-86c8-cc41aaf66124",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--c19dcd43-2a63-5290-869e-5b342abe563f",
      "target_ref": "attack-pattern--38c56b01-4c61-5ed2-a4aa-bbc3328c26db"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--8e0c9fa9-e6d3-5d39-840f-4bbadf78a32f",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--c19dcd43-2a63-5290-869e-5b342abe563f",
      "target_ref": "attack-pattern--b568d4de-f822-5177-9450-a4bc9bf1c777"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--c913618c-382c-510e-99ce-9a25b18a419b",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--c19dcd43-2a63-5290-869e-5b342abe563f",
      "target_ref": "attack-pattern--5d73fcda-34f8-53cb-94e7-4c67d2e6ca5d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--f664661a-332a-5e58-8526-cc74c8fcd47c",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--c19dcd43-2a63-5290-869e-5b342abe563f",
      "target_ref": "attack-pattern--352754b6-8cf8-5992-910a-11525df9d710"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--78f9c90d-bed8-542a-aeb4-293e90c4d6a7",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--c19dcd43-2a63-5290-869e-5b342abe563f",
      "target_ref": "malware--a2cd4475-7739-5688-a0ee-8f7b2d161c31"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--a803cd2f-70c2-5052-9f8e-74ed65e88563",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--c19dcd43-2a63-5290-869e-5b342abe563f",
      "target_ref": "malware--66a63980-d32a-5e01-9dd2-f4c23b42f034"
    }
  ]
}