PROMETHIUM
IntrusionSet · ATTACK:enterprise:G0056
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0056",
"title": "PROMETHIUM",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0056",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--efed95ba-d7e8-47ff-8c53-99c42426ee7c",
"external_id": "G0056",
"domain": "enterprise",
"created": "2018-01-16T16:13:52.465Z",
"modified": "2026-07-31T20:48:51.011Z",
"version": "2.1",
"aliases": [
"PROMETHIUM",
"StrongPity"
],
"tactics": [
],
"source_references": [
{
"source_name": "PROMETHIUM"
},
{
"source_name": "Microsoft SIR Vol 21",
"url": "http://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf"
},
{
"source_name": "Talos Promethium June 2020",
"url": "https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html"
},
{
"source_name": "Microsoft NEODYMIUM Dec 2016",
"url": "https://blogs.technet.microsoft.com/mmpc/2016/12/14/twin-zero-day-attacks-promethium-and-neodymium-target-individuals-in-europe/"
},
{
"source_name": "StrongPity"
},
{
"source_name": "Bitdefender StrongPity June 2020",
"url": "https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf"
}
]
}Explicit source assertions (14)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0056 → uses → ATTACK:enterprise:S0178
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--34ebfdf4-ef2c-4a6c-8bfa-69704d8f7694
Microsoft NEODYMIUM Dec 2016 · Microsoft SIR Vol 21ATTACK:enterprise:G0056 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--49be75c9-8484-492e-9ebc-f81d2e203e4e
Talos Promethium June 2020 · Bitdefender StrongPity June 2020ATTACK:enterprise:G0056 → uses → ATTACK:enterprise:T1587.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4ac5b593-8f47-46cc-9af3-fcb0eb20f66e
Bitdefender StrongPity June 2020ATTACK:enterprise:G0056 → uses → ATTACK:enterprise:T1078.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--56e4bdb5-a57a-463a-a396-7bed2eb6893e
Bitdefender StrongPity June 2020ATTACK:enterprise:G0056 → uses → ATTACK:enterprise:T1587.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--66e5238f-c1f7-4094-8c2e-e8e41a4c12f3
Talos Promethium June 2020ATTACK:enterprise:G0056 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--788d02cb-7a20-4115-9428-b55e598374ce
Talos Promethium June 2020ATTACK:enterprise:G0056 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--875a622a-445e-46fe-8959-8d205c88c728
Bitdefender StrongPity June 2020ATTACK:enterprise:G0056 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--92348457-3761-4298-aedc-14fa7fd4810c
Talos Promethium June 2020 · Bitdefender StrongPity June 2020ATTACK:enterprise:G0056 → uses → ATTACK:enterprise:T1036.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a5b0b3ae-737a-4f2b-bbe9-23ca214eb733
Talos Promethium June 2020 · Bitdefender StrongPity June 2020ATTACK:enterprise:G0056 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b2f7a2e7-5a72-4ace-b1de-121a8db809d8
Bitdefender StrongPity June 2020ATTACK:enterprise:G0056 → uses → ATTACK:enterprise:T1205.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b92d6b45-e211-4168-ac32-80427bf1b9d2
Bitdefender StrongPity June 2020ATTACK:enterprise:G0056 → uses → ATTACK:enterprise:S0491
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bc4252e5-6a2a-443e-9a31-16d86f4f069b
Bitdefender StrongPity June 2020 · Talos Promethium June 2020ATTACK:enterprise:G0056 → uses → ATTACK:enterprise:T1189
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e898946c-2c9d-4bf4-9253-67acfadc5b0a
Bitdefender StrongPity June 2020ATTACK:enterprise:C0033 → attributed-to → ATTACK:enterprise:G0056
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f372697e-b661-4995-9920-4ec0a9060ebb
Talos Promethium June 2020 · Bitdefender StrongPity June 2020