NEODYMIUM

Executive Summary

NEODYMIUM, an activity group linked to espionage activities, has been observed targeting Turkish individuals since at least May 2016. The group shares similarities with PROMETHIUM due to overlapping victimology and campaign characteristics, suggesting a possible connection or shared operational approach. NEODYMIUM's activities may be linked to BlackOasis operations, though no definitive evidence of alias usage has been established. The threat actor employs spear-phishing campaigns using malicious Office documents and demonstrates intermediate sophistication in targeting OSINT platforms.

Goals & Targeting

NEODYMIUM appears to primarily seekEspionage-related intelligence from its targets. This is evident from the targeting of individuals in sectors that likely handle sensitive information, such as defense, government, or OSINT professionals. The group's focus on Turkish victims suggests a potential interest in regional intelligence gathering or geopolitical espionage. NEODYMIUM's strategic goal aligns with other advanced persistent threat (APT) groups seeking to gather critical data for national security or competitive advantage purposes.

NEODYMIUM is an espionage-focused activity group that has primarily targeted individuals in Turkey through sophisticated phishing campaigns. The group's operations share notable similarities with PROMETHIUM, another suspected espionage actor, due to overlapping victim characteristics and campaign tactics. NEODYMIUM has been observed using malicious Office documents embedded with macros to deliver payloads, indicating a focus on compromising OSINT platforms. While the group demonstrates intermediate sophistication, its attacks have been effective in targeting defense and government sectors. The actor's association with BlackOasis remains speculative but suggests potential ties to larger state-sponsored or intelligence community operations. NEODYMIUM's primary toolset includes Wingbird, a piece of malware designed for data collection, exfiltration, and persistence. The group has demonstrated a patient and targeted approach, focusing on specific individuals rather than large-scale campaigns.

Key Capabilities

• Spear-phishing campaigns using malicious Office documents
• Use of malware (e.g., Wingbird) for data collection and exfiltration
• Focus on OSINT platforms as infection vectors
• Intermediate-level operational sophistication

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

NEODYMIUM has been active since at least May 2016, with its latest known activities occurring in December 2016. The group's campaigns have focused on Turkish individuals, suggesting a geographically targeted approach. NEODYMIUM's operations demonstrate similarities to PROMETHIUM, including the use of overlapping victim characteristics and malware deployment methods. These parallels raise questions about whether they are distinct groups or part of a larger campaign network. Notable operations include the targeting of OSINT users, likely to compromise sensitive data and disrupt intelligence gathering efforts.

IOC Patterns

• Spear-phishing with macro-laced Office documents
• Use of malicious hashes for payload delivery
• C2 communication via encoded protocols in files

Recommended Actions

• Implement strict monitoring of spear-phishing attempts using email security solutions
• Conduct regular user training on phishing awareness and OSINT platform hygiene
• Deploy endpoint detection and response (EDR) tools to identify malicious activity
• Analyze file hashes against known NEODYMIUM IOCs for potential lateral movement

Suggested Tags