{
	"id": "48fe3e99-0171-499d-af80-f5847fbe20c1",
	"created_at": "2026-04-06T00:14:19.580667Z",
	"updated_at": "2026-04-10T13:12:08.475702Z",
	"deleted_at": null,
	"sha1_hash": "db8b18ffe2f4cb507049991290b831f641d4b5c2",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 48907,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 20:27:05 UTC\n APT group: Neodymium\nNames\nNeodymium (Microsoft)\nG0055 (MITRE)\nCountry Turkey\nMotivation Information theft and espionage\nFirst seen 2016\nDescription\nNeodymium is an activity group that conducted a campaign in May 2016 and has\nheavily targeted Turkish victims. The group has demonstrated similarity to another\nactivity group called Promethium, StrongPity due to overlapping victim and campaign\ncharacteristics. Neodymium is reportedly associated closely with BlackOasis operations,\nbut evidence that the group names are aliases has not been identified.\n(Microsoft) Neodymium is an activity group that is known to use a backdoor malware\ndetected by Microsoft as Wingbird. This backdoor’s characteristics closely match\nFinFisher, a government-grade commercial surveillance package. Data about Wingbird\nactivity indicate that it is typically used to attack individual computers instead of\nnetworks.\nObserved Countries: Europe.\nTools used Wingbird.\nInformation\nMITRE ATT\u0026CK Last change to this card: 16 August 2025\nDownload this actor card in PDF or JSON format\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=05fb2a9c-1ffb-4a2d-87fc-4103c9c62adf\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=05fb2a9c-1ffb-4a2d-87fc-4103c9c62adf\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=05fb2a9c-1ffb-4a2d-87fc-4103c9c62adf"
	],
	"report_names": [
		"showcard.cgi?u=05fb2a9c-1ffb-4a2d-87fc-4103c9c62adf"
	],
	"threat_actors": [
		{
			"id": "10ad5c1d-5030-4300-be4e-6d24b40a6330",
			"created_at": "2022-10-25T16:07:23.400966Z",
			"updated_at": "2026-04-10T02:00:04.581114Z",
			"deleted_at": null,
			"main_name": "BlackOasis",
			"aliases": [
				"G0063"
			],
			"source_name": "ETDA:BlackOasis",
			"tools": [
				"FinFisher",
				"FinFisher RAT",
				"FinSpy",
				"Wingbird"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "27485543-d2e7-4053-a660-157489732cbb",
			"created_at": "2022-10-25T16:07:23.895403Z",
			"updated_at": "2026-04-10T02:00:04.781765Z",
			"deleted_at": null,
			"main_name": "Neodymium",
			"aliases": [
				"G0055"
			],
			"source_name": "ETDA:Neodymium",
			"tools": [
				"Wingbird"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "67fbc7d7-ba8e-4258-b53c-9a5d755e1960",
			"created_at": "2022-10-25T16:07:24.077859Z",
			"updated_at": "2026-04-10T02:00:04.860725Z",
			"deleted_at": null,
			"main_name": "Promethium",
			"aliases": [
				"APT-C-41",
				"G0056",
				"Magenta Dust",
				"Promethium",
				"StrongPity"
			],
			"source_name": "ETDA:Promethium",
			"tools": [
				"StrongPity",
				"StrongPity2",
				"StrongPity3",
				"Truvasys"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "400a3efc-44a1-4d83-a724-cd16818328f9",
			"created_at": "2023-01-06T13:46:38.516115Z",
			"updated_at": "2026-04-10T02:00:03.008975Z",
			"deleted_at": null,
			"main_name": "NEODYMIUM",
			"aliases": [
				"G0055"
			],
			"source_name": "MISPGALAXY:NEODYMIUM",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "5200f27d-0d0a-49e9-a9de-9612971126c2",
			"created_at": "2023-01-06T13:46:38.959648Z",
			"updated_at": "2026-04-10T02:00:03.163547Z",
			"deleted_at": null,
			"main_name": "BlackOasis",
			"aliases": [
				"G0063"
			],
			"source_name": "MISPGALAXY:BlackOasis",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "1ba9c064-34d2-48b5-a08c-04d241b00ebe",
			"created_at": "2022-10-25T15:50:23.734241Z",
			"updated_at": "2026-04-10T02:00:05.404606Z",
			"deleted_at": null,
			"main_name": "BlackOasis",
			"aliases": [
				"BlackOasis"
			],
			"source_name": "MITRE:BlackOasis",
			"tools": null,
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "cbede712-4cc3-47c6-bf78-92fd9f1beac6",
			"created_at": "2022-10-25T15:50:23.777222Z",
			"updated_at": "2026-04-10T02:00:05.399303Z",
			"deleted_at": null,
			"main_name": "PROMETHIUM",
			"aliases": [
				"PROMETHIUM",
				"StrongPity"
			],
			"source_name": "MITRE:PROMETHIUM",
			"tools": [
				"Truvasys",
				"StrongPity"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "c11cbeb5-461f-4bd8-a86b-f57e471a664d",
			"created_at": "2022-10-25T15:50:23.257383Z",
			"updated_at": "2026-04-10T02:00:05.414047Z",
			"deleted_at": null,
			"main_name": "NEODYMIUM",
			"aliases": [
				"NEODYMIUM"
			],
			"source_name": "MITRE:NEODYMIUM",
			"tools": [
				"Wingbird"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "4660477f-333f-4a18-b49b-0b4d7c66d482",
			"created_at": "2023-01-06T13:46:38.511962Z",
			"updated_at": "2026-04-10T02:00:03.007466Z",
			"deleted_at": null,
			"main_name": "PROMETHIUM",
			"aliases": [
				"StrongPity",
				"G0056"
			],
			"source_name": "MISPGALAXY:PROMETHIUM",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434459,
	"ts_updated_at": 1775826728,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/db8b18ffe2f4cb507049991290b831f641d4b5c2.pdf",
		"text": "https://archive.orkl.eu/db8b18ffe2f4cb507049991290b831f641d4b5c2.txt",
		"img": "https://archive.orkl.eu/db8b18ffe2f4cb507049991290b831f641d4b5c2.jpg"
	}
}