Trusted Design

PROMETHIUM

アクターID: G0056

· MITRE Pageへのリンク

脅威アクターの詳細

PROMETHIUM is an activity group focused on espionage that has been active since at least 2012. The group has conducted operations globally with a heavy emphasis on Turkish targets. PROMETHIUM has demonstrated similarity to another activity group called NEODYMIUM due to overlapping victim and campaign characteristics.(Citation: Microsoft NEODYMIUM Dec 2016)(Citation: Microsoft SIR Vol 21)(Citation: Talos Promethium June 2020)

脅威アクターの別名・別称

PROMETHIUM
StrongPity

利用した攻撃手法

• T1218.013 - Mavinject
• T1093 - Process Hollowing
• T1087.002 - Domain Account
• T1176.001 - Browser Extensions
• T1103 - AppInit DLLs
• T1530 - Data from Cloud Storage
• T1588.001 - Malware
• T1547.015 - Login Items
• T1679 - Selective Exclusion
• T1059.012 - Hypervisor CLI
• T1490 - Inhibit System Recovery

関連するCVE (攻撃手法に関連)

• CVE-2014-4114 (T1087.002)
• CVE-2015-1770 (T1087.002)
• CVE-2015-2545 (T1087.002)
• CVE-2017-0199 (T1087.002)
• CVE-2012-0158 (T1087.002)
• CVE-2013-3906 (T1087.002)
• CVE-2014-6352 (T1087.002)
• CVE-2015-0016 (T1588.001)
• CVE-2010-3333 (T1087.002)
• CVE-2010-0188 (T1087.002)
• CVE-2010-2884 (T1087.002)
• CVE-2013-0640 (T1087.002)
• CVE-2011-0611 (T1087.002)
• CVE-2015-2546 (T1176.001)
• CVE-2014-4113 (T1176.001)
• CVE-2015-1701 (T1176.001)
• CVE-2017-0263 (T1176.001)
• CVE-2015-0057 (T1176.001)
• CVE-2015-2360 (T1176.001)
• CVE-2014-4148 (T1176.001)
• CVE-2015-5477 (T1588.001)
• CVE-2017-16929 (T1588.001)
• CVE-2012-4681 (T1588.001)
• CVE-2013-7331 (T1588.001)
• CVE-2015-1427 (T1547.015)
• CVE-2012-3213 (T1547.015)
• CVE-2011-3544 (T1547.015)
• CVE-2014-8361 (T1547.015)
• CVE-2014-3897 (T1059.012)
• CVE-2016-0189 (T1059.012)
• CVE-2015-4495 (T1059.012)
• CVE-2015-2502 (T1059.012)
• CVE-2012-4792 (T1059.012)
• CVE-2014-0322 (T1059.012)
• CVE-2013-2551 (T1059.012)
• CVE-2015-0071 (T1059.012)
• CVE-2012-0611 (T1059.012)
• CVE-2015-2419 (T1059.012)
• CVE-2008-1436 (T1490)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る