The Gamaredon Group Toolset Evolution

Unit 42 describes the Gamaredon Group's shift from commodity tooling to custom malware (including Pteranodon backdoor, downloaders, and a USB/file stealer) used in campaigns targeting Ukrainian government-related individuals; the report details delivery methods (SFX archives, batch scripts, JavaScript staging), persistence and exfiltration behaviors (screenshots, file theft, remote command execution), and provides extensive IOCs (domains, URLs, and file hashes) and analysis of payload internals.