Gamaredon VBScript Payload Execution via wscript/cscript (PteroDum/PteroOdd/PteroEffigy)

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•1

Detects the execution of VBScript or VBE files (.vbs, .vbe) from common temporary or user-writable directories (Temp, AppData, tmp, ProgramData) when launched by common desktop applications (Word, Excel, PowerPoint, Outlook, mshta, explorer, cmd, or powershell). This behavior is characteristic of macro-enabled documents or droppers executing staged malicious scripts.