TurkeyUnattributedUnattributedEspionageActive 2012 – 2022

StrongPity

Also known asPROMETHIUM · APT-C-41 · Magenta Dust

7ATT&CK techniques 2Malware & tools 0Exploited CVEs 1Campaigns 4Sectors

Open the interactive dossier Diamond Model Hunt coverage Tradecraft lanes

Summary

Turkey-attributed APT targeting Kurdish communities, dissidents, and political opponents. In 2018 abused Türk Telekom ISP for HTTP interception. Trojanises legitimate software installers (Notepad++, WinRAR) as delivery.

Attribution

UnattributedNo state attribution: Unattributed

Operations centre on Turkish and Kurdish targets

Tracked by researchers; no state or organisation has been publicly attributed.

Sources

MITRE ATT&CK (MITRE ATT&CK, 2026-10)
Heavy emphasis on Turkish targets; no attribution

Campaigns 1

Campaign	Period	Targets	Sectors	Source
Trojanized Telegram app posing as Shagle (Android)	2021-11 – 2022-07	Unknown	Individuals	ESET Research (2023-01-10)

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 7

Resource Development2	`T1587.002`Code Signing Certificates `T1587.003`Digital Certificates
Initial Access1	`T1566.001`Spearphishing Attachment
Stealth3	`T1036.005`Match Legitimate Resource Name or Location `T1205.001`Port Knocking `T1078.003`Local Accounts
Credential Access1	`T1056.004`Credential API Hooking

Malware and tools 2

Name	Description	Platform
StrongPity Backdoor	Modular Backdoor	Windows/Android
Truvasys	Malware	Windows

Infrastructure patterns

Copycat sites serve trojanised apps signed with a reused certificate, e.g. a fake Shagle (ESET, 2023)

Reporting and advisories 3

Cisco Talos
PROMETHIUM extends global reach with StrongPity3 APT (Jun 2020)
ESET Research
Trojanized Telegram app posing as Shagle (Android)
MITRE ATT&CK
StrongPity (G0056) group profile