Threat Intelligence Tarot
Vol. II · 131
Turkey-aligned (suspected)
G0056★★★★★
risk 3/5
✦ The Poisoned Spring ✦
PROMETHIUM
StrongPity · APT-C-41
Kurdish targetsSyrian oppositionItalian and Belgian users (typosquatted installers)Civil society
Active since ~2012 · Regional surveillance, Domestic dissident monitoring
The Poisoned Spring waits at the well. Every download is a cup; every cup, an offering from a publisher you did not check. The springs are still flowing — only the water has changed.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆Trojanized WinRAR, TrueCrypt, and IDM installers via typosquatted domains
- ◆ISP-level traffic injection (Türk Telekom equipment, per Citizen Lab)
- ◆StrongPity malware family across multiple campaigns
- ◆Italian and Belgian users targeted by poisoned download mirrors
Defenses
- ▸Code-signing verification on all downloaded installersNIST CSF: PR.DS ↗
- ▸DNS-over-HTTPS or DNS-over-TLS on user endpointsCIS Control 9 ↗
- ▸SBOM and software inventory practices for third-party applicationsNIST SP 800-218 ↗
- ▸ISP-level integrity monitoring for journalists and at-risk usersNIST CSF: DE.CM ↗
Reversed: Their Weakness
Code-signing verification, software-supply-chain SBOM practices, and DNS-over-HTTPS for end users undermine the trio of vectors this operator depends on.
Share this adversary profile
Compare →swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.