Gamaredon_Group__2017__The_Gamaredon_Group_Toolset_Evolution_-_Palo_Alto_Networks_Blog.pdf

Palo Alto Networks Unit 42 documents the Gamaredon Group's evolution from commodity tools to custom malware (including a downloader, backdoor named "Pteranodon", and a USB/file stealer), describing delivery via passworded SFX archives and scripts, capabilities for screenshot capture, remote command execution, and data exfiltration, and provides extensive IoCs (domains, URLs, and hashes) and technical analysis to support detection and mitigation.