H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[StrongPity](https://attack.mitre.org/software/S0491) is an information stealing malware used by [PROMETHIUM](https://attack.mitre.org/groups/G0056).(Citation: Bitdefender StrongPity June 2020)(Citation: Talos Promethium June 2020)

Labels

malware

28 recorded

Relationships

uses

from C0033

Campaign

uses

from PROMETHIUM

Group

uses

to Archive via Custom Method

Technique

uses

to Asymmetric Cryptography

Technique

uses

to Automated Collection

Technique

uses

to Automated Exfiltration

Technique

uses

to Code Signing

Technique

uses

to Disable or Modify Tools

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Hidden Window

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Local Storage Discovery

Technique

uses

to Malicious File

Technique

uses

to Masquerade Task or Service

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Multi-hop Proxy

Technique

uses

to Non-Standard Port

Technique

uses

to PowerShell

Technique

uses

to Process Discovery

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Security Software Discovery

Technique

uses

to Service Execution

Technique

uses

to System Network Configuration Discovery

Technique

uses

to Web Protocols

Technique

uses

to Windows Service

Technique

3 external

References

mitre-attack

S0491

open

Talos Promethium June 2020

https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html

open

Bitdefender StrongPity June 2020

https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf

open