Loading threat actor…
Promethium, most commonly known as StrongPity, is a suspected Turkish espionage-focused threat actor active since at least 2012. Also tracked as Blue Magic Eye, APT-C-41, Magenta Dust, and SmallPity, the group is known for watering-hole compromises and trojanized installers for legitimate software, particularly privacy, encryption, remote-access, browser, security, and utility applications. Its operations have prominently affected users in Italy, Belgium, and Turkey, with wider activity across Europe, North Africa, and the Middle East. StrongPity deploys modular Windows and Android spyware capable of collecting documents, contact lists, call logs, installed-software information, and other victim data, then staging and exfiltrating that material over encrypted command-and-control channels. It has used keylogging and targeted software associated with encrypted communications. Android variants use event-triggered execution through broadcast receivers, can load additional modules, and may abuse existing root access to grant permissions. Windows tooling has maintained persistence through Registry Run keys, while mobile tooling has persisted through boot, screen, connectivity, and user-presence events. The group routinely disguises malicious installers as legitimate applications, bundles clean software as decoy content, and uses self-signed certificates to support HTTPS command-and-control communications.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
47 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
36 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced solely as an ATT&CK-associated group for Windows built-in account renaming/local-account abuse; no campaign or activity is described.
Listed as an associated threat actor in detection annotations for Ghostscript exploitation; no specific campaign activity is described in this reference.
Listed as an associated threat actor for exploitation activity related to abuse of the Windows Cloud Files API / cldapi.dll detection.
Listed as a threat actor associated with exploitation and privilege-escalation detection coverage for Windows admin password changes by non-admin users.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.