Loading threat actor…
StrongPity, also tracked as Promethium, Blue Magic Eye, APT-C-41, Magenta Dust, SmallPity, and StrongPity, is a long-running espionage-oriented threat actor active since at least 2012. The group is widely associated with surveillance and intelligence collection operations, particularly in the Middle East, and has repeatedly targeted users through trojanized installers, watering-hole compromises, and fake or repackaged legitimate software. StrongPity is best known for compromising software distribution channels and disguising malware as legitimate applications such as compression tools, encryption software, browsers, security products, and utilities. Documented operations include watering-hole attacks involving trojanized WinRAR and TrueCrypt installers and later campaigns using fake installers for other popular software. The actor has also expanded beyond Windows into Android, where it has used repackaged applications, fake mobile apps, and compromised websites to deliver mobile spyware. On Windows, StrongPity has used modular spyware capable of searching for and collecting sensitive files, compressing and encrypting stolen data, uploading it to command-and-control infrastructure, and downloading and executing additional payloads. The malware has established persistence through Registry Run keys and has used self-signed digital certificates to support HTTPS command-and-control traffic. The group has also bundled malicious installers with legitimate signed software to reduce suspicion and improve user execution success. On Android, StrongPity malware has demonstrated persistence through broadcast receivers triggered by events such as device boot, connectivity changes, screen state changes, battery events, and user presence. Mobile variants have collected call logs and contact lists and have used modular components for additional data collection. More recent Android tooling has incorporated accessibility and notification-related components, local SQLite storage, and the ability to invoke elevated commands on already rooted devices. Victimology and telemetry indicate repeated targeting in Italy, Belgium, and Turkey, with broader activity affecting parts of Europe, North Africa, and the Middle East. The actor has shown a recurring interest in users of privacy, encryption, and remote-access tools, suggesting a focus on intelligence collection against individuals or organizations likely to handle sensitive communications or documents. StrongPity is generally assessed as a technically capable espionage actor rather than a ransomware or financially motivated intrusion set.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
46 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
36 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as an associated threat actor in detection annotations for Ghostscript exploitation; no specific campaign activity is described in this reference.
Listed as an associated threat actor for exploitation activity related to abuse of the Windows Cloud Files API / cldapi.dll detection.
Listed as a threat actor associated with exploitation and privilege-escalation detection coverage for Windows admin password changes by non-admin users.
Listed as a threat actor associated with exploitation for privilege escalation and Windows service persistence/installation in the detection annotations.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.