AdversaryGraph public intelligence page

This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.

Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.

Main AdversaryGraph project Documentation Malware Analysis GitHub

G0033 · 8 ATT&CK techniques · 0 correlated reports

Poseidon Group

Aliases: None listed

Poseidon Group is a Portuguese-speaking threat group that has been active since at least 2005. The group has a history of using information exfiltrated from victims to blackmail victim companies into contracting the Poseidon Group as a security firm.

Open interactive actor investigation

ATT&CK techniques

T1049
System Network Connections DiscoveryT1003
OS Credential DumpingT1007
System Service DiscoveryT1087.002
Domain AccountT1087.001
Local AccountT1057
Process DiscoveryT1036.005
Match Legitimate Name or LocationT1059.001
PowerShell

Correlated CTI and IR reports

Continue the investigation

Interactive AdversaryGraph AdversaryGraph documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas Insider Threat Detection Guide 1200km Medium research

Cyber Knowledge routes

These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.

Module 1 — Foundations: What CTI Is
Cyber Threat Intelligence (CTI) · explicit-idModule 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-idModule 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · explicit-idModule 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameIntelligence requirements, hypotheses, and collection planning
OSINT & Reconnaissance · topic-matchPeople, organizations, brands, suppliers, and relationship research
OSINT & Reconnaissance · topic-matchModule 6 — Alert triage, investigation, and escalation
Blue Team & Defensive Security · topic-matchMemory forensics and runtime reconstruction
Digital Forensics & Incident Response (DFIR) · topic-matchIdentity, authorization, tenancy, and human approval
AI Security · topic-matchReadiness, mandate, governance, and communications
Digital Forensics & Incident Response (DFIR) · topic-match