{
  "family": "pterodo",
  "sample_count": 19,
  "category": "backdoor",
  "description": "Pterodo (also known as Pteranodon, tracked under designations including Backdoor:Win32/Pterodo, Trojan:Win32/Pterodo, and Backdoor.Pteranodon) is a specialized cyber espionage backdoor and reconnaissance framework actively developed and operated by the Russian state-sponsored advanced persistent threat actor Gamaredon (Primitive Bear, ACTINIUM, Shuckworm, UAC-0010) since at least 2014. Exclusively deployed in targeted campaigns against Ukrainian governmental, military, law enforcement, and critical infrastructure organizations, Pterodo is distributed via spear-phishing emails containing malicious Microsoft Office documents with weaponized VBA macros or dynamic remote template injection. Once executed, Pterodo drops multi-stage VBScript, AutoIt, or PowerShell payloads. It gathers extensive system enumeration telemetry (machine name, volume serial numbers, network adapters, and security software), establishes persistence via scheduled tasks and user Startup folder shortcuts, and communicates with dynamically rotating fast-flux C2 infrastructure. Pterodo's modular design enables operators to download secondary modules, capture screenshots, log keystrokes, and exfiltrate sensitive strategic military files.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor:Win32/Pterodo",
    "Trojan:Win32/Pterodo",
    "Backdoor.Pteranodon",
    "Win32/Pteranodon",
    "Pteranodon RAT",
    "Gamaredon Pterodo"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Backdoor:Win32/Pterodo?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Pterodo is a cyber espionage backdoor developed and used by the Russian state-sponsored threat group Gamaredon."
      }
    },
    {
      "@type": "Question",
      "name": "Which threat actor operates the Pterodo backdoor?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is operated by Gamaredon Group (also known as Primitive Bear, ACTINIUM, Shuckworm, and UAC-0010)."
      }
    },
    {
      "@type": "Question",
      "name": "How does Pterodo infect victim computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is delivered through spear-phishing emails delivering malicious Office attachments with VBA macros or remote template injection."
      }
    },
    {
      "@type": "Question",
      "name": "What are Pterodo's primary espionage capabilities?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It performs endpoint reconnaissance, captures screenshots, downloads secondary plugins, and exfiltrates strategic government and military files."
      }
    },
    {
      "@type": "Question",
      "name": "How does Pterodo maintain persistent access across reboots?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It creates Windows Scheduled Tasks and drops malicious shortcut (.lnk) files into the Startup directory."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.001",
    "T1059.005",
    "T1053.005",
    "T1568.002",
    "T1082",
    "T1113"
  ],
  "cisa_advisory": "AA22-047A",
  "last_updated": "2026-10-15",
  "first_seen": 2014,
  "threat_actor": "Gamaredon Group",
  "delivery_mechanism": [
    "Spear-phishing Emails with Weaponized Office Documents",
    "Remote Template Injection in Microsoft Word (.docx)",
    "Compromised Legitimate Ukrainian Websites"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Server"
  ],
  "capabilities": [
    "Reconnaissance & System Telemetry Enumeration",
    "Dynamic C2 Communication over Fast-Flux DNS Nodes",
    "Screenshot Capture and Keylogging Modules",
    "Secondary Payload & Script Downloading",
    "Scheduled Task & Startup Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "VBScript (.vbs)",
      "AutoIt Compiled Script (.exe)",
      "Win32 PE Executable"
    ],
    "network_signatures": [
      "HTTP GET/POST requests to dynamic DNS subdomains (.ru, .online, .space) requesting base64-encoded tasks",
      "Rapid DNS resolution changes across IP ranges associated with Russian VPS hosting providers"
    ],
    "evasion_techniques": [
      "Heavy script obfuscation and variable randomization in dropped VBScript files",
      "Execution of legitimate system binaries (wscript.exe, cscript.exe) to blend with normal administrative activity"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d",
      "8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\PterodoUpdate"
    ],
    "file_paths": [
      "%AppData%\\Microsoft\\Windows\\Templates\\template.vbs",
      "%UserProfile%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\update.lnk"
    ]
  },
  "defensive_measures": [
    "Block inbound emails containing macro-enabled attachments and restrict remote template injection via Office group policy",
    "Disable Windows Script Host (wscript.exe/cscript.exe) execution for regular workstation users",
    "Integrate CISA advisory AA22-047A indicators and monitor for unusual scheduled tasks executing VBScript or PowerShell"
  ],
  "sources": [
    {
      "name": "CISA Alert AA22-047A - Russian State-Sponsored Cyber Threats to Critical Infrastructure",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-047a"
    },
    {
      "name": "Microsoft Threat Intelligence - ACTINIUM (Gamaredon) Targets Ukrainian Organizations",
      "url": "https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/"
    },
    {
      "name": "CERT-UA Advisory - UAC-0010 (Gamaredon) Malicious Activity",
      "url": "https://cert.gov.ua/"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Backdoor:Win32/Pterodo.A",
      "Backdoor:Win32/Pterodo.B",
      "Trojan:VBS/Pterodo"
    ]
  },
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "collection",
    "command_and_control"
  ],
  "ecosystem": [
    "windows_pe",
    "vbscript"
  ],
  "is_emerging": false,
  "motivation": "Nation-State Cyber Espionage & Strategic Military Intelligence",
  "sample_hashes": []
}