Turkey2 malware familiesExploits CVEs in the wild

PROMETHIUM

Also known asMagenta DustPROMETHIUMSmallPityStrongPity

PROMETHIUM, also referred to as StrongPity, with aliases Magenta Dust and SmallPity, is a threat group associated in the provided content with the StrongPity malware family. The content attributes an Android malware sample posted on the Syrian e-Gov website to this group and assesses that it is actively developing Android backdoors in addition to previously reported Windows tooling. Observed delivery methods include repackaged legitimate applications, fake applications, compromised websites, and trojanized installers; the group has attempted to get users to execute compromised installation files for legitimate software such as compression tools, security software, browsers, file recovery applications, and other utilities. The malware has been disguised by bundling malicious installer files with legitimate software installers and the group has signed code with self-signed certificates. On Windows, PROMETHIUM has used Registry Run keys to establish persistence. In activity tracked as C0033, PROMETHIUM used StrongPity to communicate with command-and-control servers over HTTPS, exfiltrate data over HTTPS, and collect SMS messages, call logs, contact lists, and device information including SIM serial number. The Android tooling described in the content is modular, overlaps with previously associated StrongPity infrastructure, and includes file collection and exfiltration behavior.

Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

Start free trial

OPERATIONAL PROFILE

Targeting

Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.

Who they target

Sectors the actor has been observed targeting.

Telecommunication Services
Media & Entertainment
Government & Administration
Military

Where they target

Geographies tied to known operations.

🇹🇷 Türkiye
🇳🇱 Netherlands

MITRE ATT&CK

Tradecraft

40 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

14 of 15 tactics76 techniques×N= number of intelligence reports citing this technique

MITRE ATT&CK

TA0043

Reconnaissance

1 technique

T1595

Active Scanning

TA0042

Resource Development

2 techniques

T1587

Develop Capabilities

T1587.002×2

Code Signing Certificates

T1587.003

Digital Certificates

T1588

Obtain Capabilities

T1588.004

Digital Certificates

TA0001

Initial Access

3 techniques

T1078

Valid Accounts

T1078.003×4

Local Accounts

T1189×4

Drive-by Compromise

T1566

Phishing

T1566.001

Spearphishing Attachment

TA0002

Execution

3 techniques

T1047×2

Windows Management Instrumentation

T1059

Command and Scripting Interpreter

T1059.001×2

PowerShell

T1204

User Execution

T1204.002×11

Malicious File

TA0003

Persistence

8 techniques

T1078

Valid Accounts

T1078.003×4

Local Accounts

T1098

Account Manipulation

T1112

Modify Registry

T1136

Create Account

T1136.001

Local Account

T1205

Traffic Signaling

T1205.001

Port Knocking

T1543

Create or Modify System Process

T1543.003×14

Windows Service

T1546

Event Triggered Execution

T1547

Boot or Logon Autostart Execution

T1547.001×7

Registry Run Keys / Startup Folder

TA0004

Privilege Escalation

7 techniques

T1068

Exploitation for Privilege Escalation

T1078

Valid Accounts

T1078.003×4

Local Accounts

T1098

Account Manipulation

T1543

Create or Modify System Process

T1543.003×14

Windows Service

T1546

Event Triggered Execution

T1547

Boot or Logon Autostart Execution

T1547.001×7

Registry Run Keys / Startup Folder

T1548

Abuse Elevation Control Mechanism

TA0005

Stealth

5 techniques

T1036×2

Masquerading

T1036.003

Rename Legitimate Utilities

T1036.004

Masquerade Task or Service

T1036.005×3

Match Legitimate Resource Name or Location

T1036.008

Masquerade File Type

T1078

Valid Accounts

T1078.003×4

Local Accounts

T1205

Traffic Signaling

T1205.001

Port Knocking

T1218

System Binary Proxy Execution

T1218.011

Rundll32

T1564

Hide Artifacts

T1564.006

Run Virtual Instance

TA0112

Defense Impairment

2 techniques

T1112

Modify Registry

T1553

Subvert Trust Controls

T1553.002×2

Code Signing

TA0006

Credential Access

1 technique

T1552

Unsecured Credentials

T1552.001

Credentials In Files

TA0007

Discovery

1 technique

T1087

Account Discovery

T1087.002

Domain Account

TA0008

Lateral Movement

2 techniques

T1021

Remote Services

T1021.002×2

SMB/Windows Admin Shares

T1021.003×2

Distributed Component Object Model

T1563

Remote Service Session Hijacking

T1563.002

RDP Hijacking

TA0009

Collection

1 technique

T1005

Data from Local System

TA0011

Command and Control

4 techniques

T1071

Application Layer Protocol

T1071.001×3

Web Protocols

T1105

Ingress Tool Transfer

T1205

Traffic Signaling

T1205.001

Port Knocking

T1573

Encrypted Channel

T1573.002×2

Asymmetric Cryptography

TA0010

Exfiltration

2 techniques

T1041

Exfiltration Over C2 Channel

T1048

Exfiltration Over Alternative Protocol

T1048.001

Exfiltration Over Symmetric Encrypted Non-C2 Protocol

T1048.003

Exfiltration Over Unencrypted Non-C2 Protocol

ARSENAL

Associated malware families

2 malware families attributed to this actor across reporting.

FamilyContextEvidenceLast seen

StrongPityIf we examine another StrongPity sample ... the logic is similar — it drops a normal installer into the Temp directory and creates a directory for dropped malicious files... We believe that the StrongPity Threat actor is actively developing backdoors for Android.13May 26, 2026

ImpacketThe following analytic identifies suspicious command-line parameters associated with the use of Impacket's smbexec.py for lateral movement. This activity is significant as both Red Teams and adversaries use Impacket for remote code execution and lateral movement.2Mar 17, 2026

WEAPONIZED

Associated vulnerabilities

1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.

CVE-2025-9491Microsoft Windows LNK File UI Misrepresentation Remote Code Execution VulnerabilityIn the wildEvidence2

This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.

ACTIVITY FEED

Recent activity

20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

20 SOURCESView more in app

splunk researchNews

Apr 13, 2026

Detection: Windows EFI Volume Mount Attempt Via Mountvol | Splunk Security Content

Listed in the detection annotations as a threat actor associated with EFI volume mounting / installation-related behavior.

splunk researchNews

Apr 13, 2026

Detection: Windows Universal Data Link File Creation | Splunk Security Content

Referenced as a threat actor associated with spearphishing attachment activity involving malicious file execution and potential credential capture via UDL files.

splunk researchNews

Apr 13, 2026

Detection: Windows Binary Execution from an Archive | Splunk Security Content

Listed as a threat actor associated with the malicious file execution technique detected by this analytic.

splunk researchNews

Apr 13, 2026

Detection: Windows Suspicious QEMU Execution | Splunk Security Content

Listed as a threat actor associated with the observed use of QEMU and the -nographic flag to install a rogue Linux virtual machine for persistence and initial access.

+87 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.

Start free trial

Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping40

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal2

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs1

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables

Domains, IPs, and hashes tied to this actor, refreshed continuously.