Pteranodon
Software · ATTACK:enterprise:S0147
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0147",
"title": "Pteranodon",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0147",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--5f9f7648-04ba-4a9f-bb4c-2a13e74572bd",
"external_id": "S0147",
"domain": "enterprise",
"created": "2017-05-31T21:33:26.084Z",
"modified": "2025-04-16T20:38:12.213Z",
"version": "2.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Pterodo"
},
{
"source_name": "Palo Alto Gamaredon Feb 2017",
"url": "https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/"
},
{
"source_name": "Secureworks IRON TILDEN Profile",
"url": "https://www.secureworks.com/research/threat-profiles/iron-tilden"
},
{
"source_name": "Symantec Shuckworm January 2022",
"url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine"
}
]
}Explicit source assertions (18)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0147 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0471088d-7b45-4fec-8946-ae5bf463286b
Palo Alto Gamaredon Feb 2017 · Unit 42 Gamaredon February 2022ATTACK:enterprise:S0147 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--16632790-94dc-40ce-9c0a-2f6af0f691b1
Palo Alto Gamaredon Feb 2017 · Symantec Shuckworm January 2022ATTACK:enterprise:S0147 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--20acec2a-ce61-4794-82f9-79fa778e7a7f
Microsoft Actinium February 2022ATTACK:enterprise:S0147 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--35ae6625-8563-493c-8950-1230bd0fd122
Palo Alto Gamaredon Feb 2017 · Symantec Shuckworm January 2022 · Unit 42 Gamaredon February 2022ATTACK:enterprise:S0147 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--44908b0a-993a-4339-b30f-f0f1a64c0753
Palo Alto Gamaredon Feb 2017ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:S0147
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f33536d-eb06-4eba-8765-4379e399f3b8
Palo Alto Gamaredon Feb 2017 · Symantec Shuckworm January 2022 · Microsoft Actinium February 2022 · Unit 42 Gamaredon February 2022 · Secureworks IRON TILDEN ProfileATTACK:enterprise:S0147 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--50f39180-6e5a-476b-b18f-d4e09e83c9d9
Palo Alto Gamaredon Feb 2017ATTACK:enterprise:S0147 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d46a519-1ef9-4cdb-b737-8c7b3ffb4f0e
Palo Alto Gamaredon Feb 2017ATTACK:enterprise:S0147 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7ce7aa48-afa9-4eb6-8bc2-8f04fd6cf00e
Microsoft Actinium February 2022ATTACK:enterprise:S0147 → uses → ATTACK:enterprise:T1027.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--975d47f9-976e-438a-bd18-2e7e0125aa44
Microsoft Actinium February 2022ATTACK:enterprise:S0147 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--97b13d6e-ad8d-42db-90cf-90c7189763cb
Symantec Shuckworm January 2022ATTACK:enterprise:S0147 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a20b8e4c-330f-4e91-b4f6-e58e5800d690
Palo Alto Gamaredon Feb 2017ATTACK:enterprise:S0147 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--acc40539-13a0-4577-a862-e348962bf0fc
Palo Alto Gamaredon Feb 2017ATTACK:enterprise:S0147 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c8bceb4a-0cf2-43c9-9729-20ed706c4c72
Palo Alto Gamaredon Feb 2017ATTACK:enterprise:S0147 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c93bb2b9-bd22-4e14-b884-2141168387b2
Palo Alto Gamaredon Feb 2017ATTACK:enterprise:S0147 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c9a7b01c-5ba6-41db-944a-ed5ba8531398
Unit 42 Gamaredon February 2022ATTACK:enterprise:S0147 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d4e67bb3-dcb2-4427-a48e-d8b4bcc35afa
Symantec Shuckworm January 2022ATTACK:enterprise:S0147 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dbacc7d5-5d10-4b41-994d-51e0792cfb19
Palo Alto Gamaredon Feb 2017 · Symantec Shuckworm January 2022