G0033 · 8 ATT&CK techniques · 0 correlated reports

Poseidon Group

Aliases: None listed

Poseidon Group is a Portuguese-speaking threat group that has been active since at least 2005. The group has a history of using information exfiltrated from victims to blackmail victim companies into contracting the Poseidon Group as a security firm.

Open interactive actor investigation

ATT&CK techniques

T1049
System Network Connections DiscoveryT1003
OS Credential DumpingT1007
System Service DiscoveryT1087.002
Domain AccountT1087.001
Local AccountT1057
Process DiscoveryT1036.005
Match Legitimate Name or LocationT1059.001
PowerShell

Correlated CTI and IR reports

Continue the investigation

Interactive ThreatMapper ThreatMapper documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas ITDR Handbook 1200km Medium research