Threat intelligence / Group

PROMETHIUM

[PROMETHIUM](https://attack.mitre.org/groups/G0056) is an activity group focused on espionage that has been active since at least 2012. The group has conducted operations globally with a heavy emphasis on Turkish targets. [PROMETHIUM](https://attack.mitre.org/groups/G0056) has demonstrated similarity to another activity group called [NEODYMIUM](https://attack.mitre.org/groups/G0055) due to overlapping victim and campaign characteristics.(Citation: Microsoft NEODYMIUM Dec 2016)(Citation: Microsoft SIR Vol 21)(Citation: Talos Promethium June 2020)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[PROMETHIUM](https://attack.mitre.org/groups/G0056) is an activity group focused on espionage that has been active since at least 2012. The group has conducted operations globally with a heavy emphasis on Turkish targets. [PROMETHIUM](https://attack.mitre.org/groups/G0056) has demonstrated similarity to another activity group called [NEODYMIUM](https://attack.mitre.org/groups/G0055) due to overlapping victim and campaign characteristics.(Citation: Microsoft NEODYMIUM Dec 2016)(Citation: Microsoft SIR Vol 21)(Citation: Talos Promethium June 2020)

14 recorded

Relationships

attributed-to

from C0033

Campaign

uses

to Code Signing

Technique

uses

to Code Signing Certificates

Technique

uses

to Digital Certificates

Technique

uses

to Drive-by Compromise

Technique

uses

to Local Accounts

Technique

uses

to Malicious File

Technique

uses

to Masquerade Task or Service

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Port Knocking

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

Malware

uses

Malware

uses

to Windows Service

Technique

7 external

References

mitre-attack

G0056

PROMETHIUM

—

Microsoft SIR Vol 21

http://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf

Talos Promethium June 2020

https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html

Microsoft NEODYMIUM Dec 2016

https://blogs.technet.microsoft.com/mmpc/2016/12/14/twin-zero-day-attacks-promethium-and-neodymium-target-individuals-in-europe/

StrongPity

—

Bitdefender StrongPity June 2020

https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf