Gamaredon_Group__2022__Symantec-Shuckworm-Espionage-Group-Campaign-Against-Ukraine_04-20-2022.pdf

Symantec reports that the Russian-linked Shuckworm espionage group continues an intense, persistent campaign against Ukrainian organizations using multiple variants of the Backdoor.Pterodo VBS droppers (variants B, C, D, E), scheduled-task persistence, API hammering, PowerShell fetch-and-execute stages, and additional tools like UltraVNC and Process Explorer; the analysis includes malware behavior, C2 domains and IOCs, and mitigation guidance.