PROMETHIUM extends global reach with Strong Pity3 APT
Summary: Cisco Talos identified roughly 30 new command-and-control domains tied to PROMETHIUM, a threat actor active since 2012, with StrongPity3 samples targeting victims in Colombia, India, Canada and Vietnam. The group used at least four trojanized installers - Firefox, VPNpro, DriverPack and 5kPlayer - which install the legitimate application alongside malware, in some cases reconfiguring Windows Defender exclusions before dropping the payload.
What's compelling: Talos could not pinpoint the initial infection vector, assessing it may be a watering hole or in-path request interception by an ISP, as CitizenLab documented in 2018 - meaning a user downloading a legitimate application from its official site may still be the entry point.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026