MALWARE FAMILY

POORTRY

Internal ID: win.poortry

aliases

Last seen:Mar 17, 2026

Intelligence Profile

According to Mandiant, POORTRY is a malware written as a driver, signed with a Microsoft Windows Hardware Compatibility Authenticode signature. This malware has been observed being used by UNC3944.

Threat Analysis

POORTRY is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa

→https://acsense.com/blog/a-guide-to-scattered-spider-data-breaches/

→https://blog.bushidotoken.net/2023/08/tracking-adversaries-scattered-spider.html

→https://www.bleepingcomputer.com/news/security/poortry-windows-driver-evolves-into-a-full-featured-edr-wiper/

→https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware

→https://www.quorumcyber.com/threat-actors/scattered-spider-threat-actor-profile/

→https://www.rapid7.com/blog/post/scattered-spider-rapid7-insights-observations-and-recommendations/

→https://www.trellix.com/about/newsroom/stories/research/scattered-spider-the-modus-operandi/

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.poortry

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search POORTRY