Pterodo

Overview

Backdoor:Win32/Pterodo (also known as Pteranodon) is a highly customized, actively maintained espionage backdoor utilized exclusively by the Gamaredon group (Primitive Bear / ACTINIUM), a Russian state-sponsored Advanced Persistent Threat (APT) widely attributed to the FSB. It primarily targets Ukrainian military, government, and critical infrastructure entities.

Understanding Pterodo
To the victim, a Pterodo infection is completely invisible, designed for long-term cyber espionage. For threat intelligence analysts, Pterodo is a dynamic and relentless threat. The Gamaredon group is known for its high-volume, highly persistent operational tempo. Pterodo is not a single executable; it is a modular framework, often consisting of a complex chain of heavily obfuscated VBScript, PowerShell, and SFX (Self-Extracting Archive) components designed to maintain access and exfiltrate sensitive documents.

Execution and APT Espionage Tactics
Initial access is almost always achieved via highly targeted spearphishing emails containing malicious Word documents with macros or weaponized LNK files (`T1566.001`). Upon execution, Pterodo heavily relies on scripting (`T1059.005`) to evade traditional AV. It establishes persistence via the Startup folder or Scheduled Tasks (`T1053.005`). A hallmark of Pterodo is its aggressive beaconing and highly dynamic Command and Control (C2) infrastructure. It frequently updates its C2 domains via Telegram channels or fast-flux DNS (`T1568.002`). The backdoor modules are designed to enumerate the system (`T1082`), capture screenshots, log keystrokes, and systematically exfiltrate documents (`.doc`, `.xls`, `.pdf`) via HTTP POST requests (`T1041`).

Indicators of Compromise & Impact
The impact is severe, state-level data theft. EDR platforms must alert on `wscript.exe` or `powershell.exe` making outbound network connections, or the anomalous execution of `.vbs` scripts from the `%Temp%` or `%AppData%` directories. Network defenders should look for high-frequency HTTP beaconing to frequently rotating, often poorly obfuscated, dynamic DNS domains (e.g., `.ru`, `.ddns.net`).

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1059.005: Restrict execution of scripting languages such as PowerShell, VBScript, or Python to authorized administrators. Enforce Script Block Logging.
• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_PTERODO {
    meta:
        description = "Detects Pterodo (backdoor)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "pterodo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Pterodo Activity
id: ca26edf251d52000441dc9d388318131
status: experimental
description: Detects generic indicators of the pterodo malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*pterodo*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately isolate the infected endpoint from the network; this is a state-sponsored espionage incident, and active exfiltration is likely ongoing.
2. Engage a dedicated incident response team. Assume the attacker has lateral movement capabilities and has compromised other hosts.
3. Capture a full forensic memory image (RAM) to recover the de-obfuscated VBScript logic and identify the current, dynamically generated C2 domains.
4. Perform a sweeping enterprise-wide hunt for the identified C2 domains and any instances of anomalous `wscript.exe` activity.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not simply re-image the machine without conducting a full forensic investigation; understanding the scope of the exfiltrated data is critical.
2. Avoid tipping off the attackers by blocking C2 domains one by one; coordinate a simultaneous block and remediation across the entire enterprise.

References & External Analysis

• Search "pterodo" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: backdoor)

Explore other malware families in the same category:

• Hacdef
• Winvnc
• Himera
• Mydoom
• Werpoapt

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/pterodo.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.