Gamaredon VBScript Dropper Execution via wscript/cscript (PteroVDoor/PteroPSDoor)

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects the execution of known Gamaredon (Shuckworm/ACTINIUM) VBScript-based payloads, including PteroVDoor, PteroPSDoor, PteroPaste, PteroDee, and PteroCache, executed via wscript.exe or cscript.exe. It also monitors for suspicious child process spawning behavior where these scripts or WinRAR launch mshta.exe, which is a common pattern observed in Gamaredon staging and lateral movement activities.