We're gradually updating threat actor names in our reports to align with the new weather-themed taxonomy. Learn about Microsoft threat actor names
TrojanDownloader:Win32/PterodoGen.A!dha
Aliases: No associated aliases
Summary
Microsoft Defender Antivirus detects and removes this threat.
This threat has been active since at least 2013. This backdoor has been observed to be used by the threat group named ACTINIUM, which has been operational for almost a decade and has consistently pursued access to organizations in Ukraine or entities related to Ukrainian affairs.
PterodoGen sends sensitive information about the host to a command-and-control address. It is also capable of establishing remote access connections, capturing keyboard input, downloading and uploading files, dropping malware payloads, performing denial-of-service (DoS) attacks, and running or terminating processes.
Read the following blog for more information:
Microsoft Defender Antivirus automatically removes threats as they are detected. If you have cloud-delivered protection, your device gets the latest defenses against new and unknown threats. If you don't have this feature enabled, update your antimalware definitions and run a full scan to remove this threat.
To help reduce the impact of this threat, you can:
- Contact your incident response team and start the incident response process. If you don't have one, contact Microsoft support for forensic investigation and remediation services. A forensic investigation is important to assess the damage that might have been done.
- Immediately isolate the affected device. Disconnect this device from the network to prevent further infiltration. If malicious code has been launched, it is likely that the device is under complete attacker control.
- Identify potentially-compromised accounts and begin monitoring for anomalous usage. Reset passwords and/or decommission confirmed affected user accounts.
- Collect and provide the investigation team with indicators of compromise (IOC) for further analysis.
You can also visit our advanced troubleshooting page or search the Microsoft virus and malware community for more help.
