Truvasys

Executive Summary

Truvasys is a Delphi‑based first‑stage malware used by the PROMETHIUM group to establish initial persistence on Windows systems. It functions as a modular loader, enabling attackers to inject additional capabilities during execution. The code is designed for stealth and resilience against signature detection. key_capabilities":["Initial persistence via registry run keys or scheduled tasks","Modular architecture to load additional plug‑ins at run time","Encrypted network communications to remote command server","Obfuscation of payloads and minimal logging", "Remote file download or copy mechanisms"] recommended_actions":["Enable advanced threat protection to detect unknown Delphi binaries","Monitor system for new scheduled tasks or registry modifications in HKCU\Software\Microsoft\Windows\CurrentVersion\Run","Block outbound network connections from unapproved executables to known malicious domains and IPs","Maintain up‑to‑date endpoint detection and response (EDR) solutions that support runtime monitoring for unexpected module loading","Apply the principle of least privilege, disabling unnecessary user rights on corporate workstations","Use application whitelisting to restrict execution of unsigned binaries"] confidence_assessment":"The analysis is based solely on limited public sources and lacks concrete sample data or observed behaviors. While structural details are known (Delphi language, modular design), specific indicators such as file hashes, network C2 addresses, and precise capabilities remain undocumented, creating uncertainty about detection efficacy.", suggested_tags":["Malware","Delphi","FirstStage","Modular","Windows","PROMETHIUM","PERSISTENCE","RemoteFileCopy","CommandAndControl"] mitre_techniques":["T1055","T1105","T1071"]}

Truvasys is a Windows‑based entry point that has been identified by Microsoft’s Defender and in the National Intelligence Center's NEODYMIUM reports. The code base is written in Delphi and consists of a modular framework designed to load additional components after the initial compromise. This first‑stage component serves as a flexible dropper, allowing the attacker to extend capabilities on a run‑time basis without redeploying a new binary. Once executed, Truvasys typically creates persistence via scheduled tasks or registry run keys and then downloads or copies ancillary modules from command‑and‑control locations. The modular architecture allows it to pivot quickly between different operational needs—such as data exfiltration, credential harvesting, or lateral movement—by simply loading new plug‑ins. Because the malware is distributed as a Delphi application, it may blend into legitimate software environments that use similar development tools and can evade signature‑based detection if not monitored by advanced heuristics or behavioral analysis. In addition to its modular nature, Truvasys demonstrates an emphasis on stealth: it uses encrypted payloads, minimal logging, and only activates its network connections when instructed via a hidden configuration file. This strategy aligns with current malicious campaigns which prioritize low visibility while maintaining broad operational flexibility. Overall, Truvasys represents a well‑constructed foothold used by the PROMETHIUM threat group to initiate and coordinate subsequent stages of their attacks across compromised Windows networks.