{
  "family": "pterodo",
  "sample_count": 19,
  "category": "backdoor",
  "description": "Backdoor:Win32/Pterodo (also known as Pteranodon) is a highly customized, actively maintained espionage backdoor utilized exclusively by the Gamaredon group (Primitive Bear / ACTINIUM), a Russian state-sponsored Advanced Persistent Threat (APT) widely attributed to the FSB. It primarily targets Ukrainian military, government, and critical infrastructure entities.<br><br><b>Understanding Pterodo</b><br>To the victim, a Pterodo infection is completely invisible, designed for long-term cyber espionage. For threat intelligence analysts, Pterodo is a dynamic and relentless threat. The Gamaredon group is known for its high-volume, highly persistent operational tempo. Pterodo is not a single executable; it is a modular framework, often consisting of a complex chain of heavily obfuscated VBScript, PowerShell, and SFX (Self-Extracting Archive) components designed to maintain access and exfiltrate sensitive documents.<br><br><b>Execution and APT Espionage Tactics</b><br>Initial access is almost always achieved via highly targeted spearphishing emails containing malicious Word documents with macros or weaponized LNK files (`T1566.001`). Upon execution, Pterodo heavily relies on scripting (`T1059.005`) to evade traditional AV. It establishes persistence via the Startup folder or Scheduled Tasks (`T1053.005`). A hallmark of Pterodo is its aggressive beaconing and highly dynamic Command and Control (C2) infrastructure. It frequently updates its C2 domains via Telegram channels or fast-flux DNS (`T1568.002`). The backdoor modules are designed to enumerate the system (`T1082`), capture screenshots, log keystrokes, and systematically exfiltrate documents (`.doc`, `.xls`, `.pdf`) via HTTP POST requests (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe, state-level data theft. EDR platforms must alert on `wscript.exe` or `powershell.exe` making outbound network connections, or the anomalous execution of `.vbs` scripts from the `%Temp%` or `%AppData%` directories. Network defenders should look for high-frequency HTTP beaconing to frequently rotating, often poorly obfuscated, dynamic DNS domains (e.g., `.ru`, `.ddns.net`).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1568.002",
    "T1053.005",
    "T1059.005",
    "T1041",
    "T1566.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1059.005",
      "name": "Command and Scripting Interpreter: Visual Basic",
      "tactic": "Execution"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1568.002",
      "name": "Dynamic Resolution: Domain Generation Algorithms",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Immediately isolate the infected endpoint from the network; this is a state-sponsored espionage incident, and active exfiltration is likely ongoing.",
    "Engage a dedicated incident response team. Assume the attacker has lateral movement capabilities and has compromised other hosts.",
    "Capture a full forensic memory image (RAM) to recover the de-obfuscated VBScript logic and identify the current, dynamically generated C2 domains.",
    "Perform a sweeping enterprise-wide hunt for the identified C2 domains and any instances of anomalous `wscript.exe` activity."
  ],
  "what_to_avoid": [
    "Do not simply re-image the machine without conducting a full forensic investigation; understanding the scope of the exfiltrated data is critical.",
    "Avoid tipping off the attackers by blocking C2 domains one by one; coordinate a simultaneous block and remediation across the entire enterprise."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}