Truvasys

MITRE ATT&CK: S0178 View on attack.mitre.org

Aliases: Truvasys

Malware type
trojan, downloader
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 12:49:45

Targeted industries: government-and-public-sector technology-and-telecommunications

Targeted regions: country_code:tr

Context

Truvasys is first-stage malware that has been used by PROMETHIUM. It is a collection of modules written in the Delphi programming language.

Detection coverage

  • 32 Sigma rules

Malware & tools used

  • Registry Run Keys / Startup Folder (attack-pattern)
  • Masquerade Task or Service (attack-pattern)

Used by threat actors

Reports & references

  • Microsoft — Twin Zero Day Attacks Promethium And Neodymium Target Individuals In Europe (report)
  • Microsoft — Microsoft Security Intelligence Report Volume 21 English (report)
  • MITRE ATT&CK — S0178 (report)
  • Microsoft — Malware Encyclopedia Description (report)

External references