Gamaredon PteroPaste/PteroDee/PteroCache Encoded PowerShell Downloader Execution

Ethan Andrews@eandrews

•updated Jun 25, 2026•2•0•10

Detects execution of PowerShell commands indicative of Gamaredon (Shuckworm) threat group activity. The rule monitors for PowerShell processes utilizing command-line arguments typical of their 2025 downloader toolset (such as PteroPaste, PteroDee, and PteroCache), specifically combining encoded commands, in-memory execution (IEX/Invoke-Expression), and remote file fetching (DownloadString).