Gamaredon PteroVDoor VBScript spawning PowerShell from Office or TEMP directory

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•2

Detects the Gamaredon PteroVDoor malware chain, including initial execution of obfuscated VBScript files from Office applications or temporary folders, the spawning of PowerShell with obfuscated arguments, subsequent C2 communication over common ports to dynamic DNS domains, and secondary WMI event subscription persistence.