PteroGraphin
PteroGraphin is a Gamaredon PowerShell tool first discovered in August 2024. It is used to establish persistence and deliver additional payloads on compromised systems. Early versions used an uncommon persistence mechanism based on Microsoft Excel add-ins; later versions replaced that method with scheduled tasks, and some reporting describes both Excel add-ins and scheduled tasks being used. PteroGraphin uses the Telegraph API for command-and-control or an encrypted payload-delivery channel.
The malware is part of Gamaredon’s broader toolset used in cyberespionage operations targeting Ukraine, particularly governmental, military, defense, law-enforcement, and related organizations. Gamaredon commonly gains access through spearphishing and malicious LNK-based infection chains, although the initial access vector in the specific PteroGraphin-linked co-compromise cases was not confirmed.
Across incidents observed between February and June 2025, ESET reported that Gamaredon tooling including PteroGraphin was used on Ukrainian systems in operations associated with Turla. In these cases, PteroGraphin and related Gamaredon tools were used to deploy or help recover Turla’s Kazuar backdoor; in at least one case, PteroGraphin was used as a recovery method to restart Kazuar, likely after a crash or failed autostart. Reporting also describes an attack chain in which PteroGraphin downloaded the PowerShell downloader PteroOdd, which then retrieved a payload from Telegraph to execute Kazuar. Additional reported infrastructure and indicators tied to related activity include exfiltration of the victim computer name and system drive volume serial number to a Cloudflare Workers subdomain, system profiling sent to eset.ydns[.]eu, and Kazuar v2 delivery from 91.231.182[.]187. ESET also noted that PteroGraphin contains a hardcoded token allowing modification of C2 pages.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
PteroGraphin : Discovered in August 2024, this PowerShell tool initially used an uncommon persistence method involving Microsoft Excel add-ins. It creates an encrypted communication channel for payload delivery, through the Telegraph API.
PteroGraphin is a PowerShell tool that uses Microsoft Excel add-ins and scheduled tasks as a persistence mechanism and uses the Telegraph API for command-and-control (C2). It was first discovered in August 2024.
Techniques & procedures
7 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
3 techniques
Execution
Later versions simplified persistence by using scheduled tasks instead.
Across incidents observed between February and June 2025, Gamaredon tooling, including PteroGraphin and PteroOdd, was used to deploy Turla’s Kazuar backdoor and, in at least one case, restore Turla’s access after the group appeared to have lost its foothold.
Persistence
2 techniques
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Stealth
1 technique
Stealth
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Gamaredon tooling used to facilitate deployment of Turla's Kazuar backdoor on compromised Ukrainian targets.
Gamaredon tooling used to facilitate deployment of Turla’s Kazuar backdoor on compromised systems.
Gamaredon implant/tooling used during intrusions; the report notes it contains a hardcoded token that allows modifying C2 pages, relevant to hypotheses about potential infrastructure hijacking.
A Gamaredon PowerShell tool used for persistence (Excel add-ins, scheduled tasks) and C2 via the Telegraph API; observed being used to launch/restart Turla's Kazuar backdoor and to download follow-on payloads.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.