NEODYMIUM is an activity group that conducted a campaign in May 2016 and has primarily targeted Turkish victims. This group has demonstrated overlapping victim and campaign similarities to another activity group called PROMETHIUM. NEODYMIUM is reportedly associated closely with BlackOasis operations, but evidence that the group names are aliases has not been confirmed.

This is a collection of rules based on the presence of indicators of compromise publicly reported as associated with this malicious actor.