Loading malware…
PteroGraphin is a PowerShell malware tool used by the Russia-aligned Gamaredon threat actor in cyberespionage operations targeting Ukraine. First observed in 2024, it is designed to establish persistence on compromised Windows systems and to create an encrypted channel for payload delivery and command-and-control through the Telegraph API. Early variants used Microsoft Excel add-ins as an uncommon persistence mechanism, while later versions shifted to scheduled tasks. PteroGraphin forms part of Gamaredon’s broader Ptero* toolset, which is associated with sustained intrusions against Ukrainian governmental, military, and other state-linked organizations.
Operational reporting from 2025 links PteroGraphin to incidents in which Gamaredon activity facilitated deployment and recovery of Turla’s Kazuar backdoor on selected Ukrainian systems. In those cases, PteroGraphin was used alongside other Gamaredon components to help execute or restart Kazuar, indicating a role in payload staging, access maintenance, and post-compromise support. This places PteroGraphin within an espionage-focused intrusion chain rather than as a standalone end-stage implant.
High-confidence behavior attributed to PteroGraphin includes persistence, encrypted payload retrieval, and support for follow-on malware delivery. It runs on Windows and has been observed in campaigns that are commonly associated with spearphishing and malicious LNK-based infection chains used by Gamaredon, although a direct delivery mechanism specific to PteroGraphin itself is not firmly established in the available facts.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Inside Gamaredon 2025: Zero-Click Espionage at Scale PteroGraphin ... Gamaredon X Turla collab PteroGraphin
Inside Gamaredon 2025: Zero-Click Espionage at Scale PteroGraphin ... Gamaredon X Turla collab PteroGraphin
7 distinct techniques documented for this family, organized by ATT&CK tactic.
Later versions simplified persistence by using scheduled tasks instead.
Across incidents observed between February and June 2025, Gamaredon tooling, including PteroGraphin and PteroOdd, was used to deploy Turla’s Kazuar backdoor and, in at least one case, restore Turla’s access after the group appeared to have lost its foothold.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Gamaredon tooling used to facilitate deployment of Turla's Kazuar backdoor on compromised Ukrainian targets.
Gamaredon tooling used to facilitate deployment of Turla’s Kazuar backdoor on compromised systems.
A named Gamaredon malware/tool referenced in 2025 reporting, associated with espionage activity.
Gamaredon implant/tooling used during intrusions; the report notes it contains a hardcoded token that allows modifying C2 pages, relevant to hypotheses about potential infrastructure hijacking.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.