NEODYMIUM

Known Names 2 entries

Observed Target Countries 1

Based on ETDA data — countries highlighted in red

Description

Neodymium is an activity group that conducted a campaign in May 2016 and has heavily targeted Turkish victims. The group has demonstrated similarity to another activity group called {{Promethium, StrongPity}} due to overlapping victim and campaign characteristics. Neodymium is reportedly associated closely with {{BlackOasis}} operations, but evidence that the group names are aliases has not been identified. (Microsoft) Neodymium is an activity group that is known to use a backdoor malware detected by Microsoft as Wingbird. This backdoor’s characteristics closely match FinFisher, a government-grade commercial surveillance package. Data about Wingbird activity indicate that it is typically used to attack individual computers instead of networks.

Tools Used 1

Reports & References 1