APT / THREAT GROUP

POORTRY

aliases

Last seen:Mar 17, 2026

Intelligence Profile

According to Mandiant, POORTRY is a malware written as a driver, signed with a Microsoft Windows Hardware Compatibility Authenticode signature. This malware has been observed being used by UNC3944.

Threat Analysis

POORTRY is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa

→https://acsense.com/blog/a-guide-to-scattered-spider-data-breaches/

→https://blog.bushidotoken.net/2023/08/tracking-adversaries-scattered-spider.html

→https://www.bleepingcomputer.com/news/security/poortry-windows-driver-evolves-into-a-full-featured-edr-wiper/

→https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

POORTRYwin.poortry

External Intelligence

Malpedia: win.poortry

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search POORTRY