H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Pteranodon](https://attack.mitre.org/software/S0147) is a custom backdoor used by [Gamaredon Group](https://attack.mitre.org/groups/G0047). (Citation: Palo Alto Gamaredon Feb 2017)

Labels

malware

18 recorded

Relationships

uses

from Gamaredon Group

Group

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Dynamic API Resolution

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Local Data Staging

Technique

uses

to Mshta

Technique

uses

to Native API

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Rundll32

Technique

uses

to Scheduled Task

Technique

uses

to Screen Capture

Technique

uses

to Virtualization/Sandbox Evasion

Technique

uses

to Visual Basic

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

5 external

References

mitre-attack

S0147

open

Pterodo

—

Palo Alto Gamaredon Feb 2017

https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/

open

Secureworks IRON TILDEN Profile

https://www.secureworks.com/research/threat-profiles/iron-tilden

open

Symantec Shuckworm January 2022

https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine

open