PteranodonMalware
- Pterodo
Pteranodon is a custom backdoor used by Gamaredon Group.From MITRE ATT&CK
Last reported yesterday, by The Hacker News5 reports
ATT&CK techniques
6 of 8 · each with the sentence it comes from- T1053.005Scheduled Task
“It then establishes persistence by creating a scheduled task to execute this ADS before terminating.”
- T1027.006HTML Smuggling
“Next, it initiates a HTML Smuggling technique with a Base64-encoded RAR archive embedded in its source code, named 2_14_6_1033_09.12.2025.rar and exploiting CVE-2025-8088.”
- T1027.009Embedded Payloads
“A decryption routine first handles the unpacking of embedded payloads by decoding Base64 strings and applying a second XOR operation using a hardcoded key.”
- T1036Masquerading
“To maintain a resilient connection with C2 server, GammaWorm establishes a persistence mechanism masquerading as a system maintenance tool.”
- T1221Template Injection
“Over the past four months, these techniques have consisted of spearphishing, remote document template injection, startup folder persistence, VBA/VBScript languages, and Dynamic DNS command & control infrastructure.”
- T1546.013PowerShell Profile
“…to achieve remote code execution if a file is written to specific locations, such as persistence paths (e.g., Programs\Startup) as PowerShell profile, or by replacing a DLL to exploit a DLL search order hijacking vulnerability.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack“Furthermore, a Gamaredon-linked downloader called Pterodo has been used to retrieve and execute InvisiMole, a modular spyware program put to use against targets in Ukraine and Russia.”
-
FSB’s matryoshka #3/3: Gamaredon's Gammasteel Infostealer“Over the past decade, their espionage arsenal has heavily evolved, shifting from the Pteranodon framework to highly modular, standalone payloads tracked under various names.”
-
FSB’s matryoshka #2/3: Gamaredon's Gammaload Malware“Over the past decade, their espionage arsenal has heavily evolved, shifting from the Pteranodon framework to highly modular, standalone payloads tracked under various names.”
-
FSB’s matryoshka #1/3: Inside Gamaredon Cyber Operations“…eral distinct malware families historically attributed to Gamaredon: a worm, loaders and a stealer, widely tracked by the community as Pteranodon, GammaLoad, and GammaSteel.”
-
Playing defense against Gamaredon Group“Pteranodon update”
Indicators in its reports
named in the reports above- lesma[.]euin 2 reports
- check-host[.]netin 2 reports
- hxxps://bold.zsjtn41091.workers[.]devin 2 reports
- bold.zsjtn41091.workers[.]devin 2 reports
- mil.gov[.]uain 1 report
- teletype[.]inin 1 report
- write[.]asin 1 report
- tebi[.]ioin 1 report
- de-fra.i3storage[.]comin 1 report
- s3.tebi[.]ioin 1 report
- hxxps://justsstop[.]ru/in 1 report
- justsstop[.]ruin 1 report
- hxxps://165.22.170[.]129/in 1 report
- 165.22.170[.]129in 1 report
- norosta[.]ruin 1 report
- selltosell[.]ruin 1 report
- hxxps://rentry[.]co/hwzrmfkxin 1 report
- serveirc[.]comin 1 report
- webhop[.]mein 1 report
- serveftp[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.