- Category
- State · Attributed to a state or working for one.
- Origin
- Türkiye(high confidence)
- Motivation
- Information theft and espionage
- Seen
- 2016–2026
- Status
- Active
- ATT&CK
- G0055
- Sources
- 10 sources carry it
- Identifier
- GINC-APT-0066 · neodymium
TürkiyeWhat it is
NEODYMIUM is an activity group that conducted a campaign in May 2016 and has heavily targeted Turkish victims. The group has demonstrated similarity to another activity group called PROMETHIUM due to overlapping victim and campaign characteristics. NEODYMIUM is reportedly associated closely with BlackOasis operations, but evidence that the group names are aliases has not been identified.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- MITRE ATT&CK
- G0055
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTTürkiye
- ThreatActor.info (Malpedia et al.)Türkiye · high
Tools
The tools and malware families the sources tie to it.
- Backdoor.Oldrea
- FinFisher
- Wingbird
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de