POORTRY
- Malware type
- rootkit
- Profile updated
- 2026-07-07 13:08:06
Targeted industries: technology-and-telecommunications government-and-public-sector
Context
According to Mandiant, POORTRY is a malware written as a driver, signed with a Microsoft Windows Hardware Compatibility Authenticode signature. This malware has been observed being used by UNC3944.
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Poortry_Auto (yara-rule)
Reports & references
- Broadcom/Symantec — Bluebottle Banks Targeted Africa (report)
- trellix.com — Scattered Spider The Modus Operandi (report)
- blog.bushidotoken.net — Tracking Adversaries Scattered Spider (report)
- quorumcyber.com — Scattered Spider Threat Actor Profile (report)
- rapid7.com — Scattered Spider Rapid7 Insights Observations And Recommendations (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Poortry (report)
- Mandiant — Hunting Attestation Signed Malware (report)
- bleepingcomputer.com — Poortry Windows Driver Evolves Into A Full Featured Edr Wiper (report)
- acsense.com — A Guide To Scattered Spider Data Breaches (report)