Tag: kazuar

4 Attack Reports | 0 Vulnerabilities

Attack reports

The Gentlemen ransomware: Dissecting a self-propagating Go encryptor

The Gentlemen is a ransomware-as-a-service operation tracked as Storm-2697, distinguished by combining robust per-file encryption using Curve25519 with XChaCha20 stream cipher alongside aggressive self-propagation capabilities designed for broad network compromise. Emerging in mid-2025 and transiti…

ransomware-as-a-service

Published: May 28, 2026

Downloadable IOCs: 2

Kazuar: Anatomy of a nation-state botnet

Kazuar is a sophisticated malware attributed to Russian state actor Secret Blizzard, having evolved from a traditional backdoor into a highly modular peer-to-peer botnet ecosystem. The malware comprises three distinct module types—Kernel, Bridge, and Worker—that distribute functionality across infe…

c2 infrastructure

diplomatic targeting

modular architecture

peer-to-peer botnet

Published: May 14, 2026

Downloadable IOCs: 4

Command & Evade: Turla's Kazuar v3 Loader

Turla's Kazuar v3 loader employs sophisticated techniques to evade detection. It uses a VBScript to drop files and execute a native loader, which bypasses security measures and leverages COM for stealth. The loader utilizes control flow redirection, patchless ETW and AMSI bypasses, and COM integrat…

in-memory execution

Published: January 15, 2026

Downloadable IOCs: 15

Gamaredon X Turla collaboration

ESET Research has uncovered collaboration between notorious APT groups Gamaredon and Turla, both associated with Russia's FSB, targeting high-profile victims in Ukraine. The research reveals Gamaredon tools being used to restart and deploy Turla's Kazuar backdoor on compromised machines. This marks…

Published: September 27, 2025

Downloadable IOCs: 0

Click here to see more Attack Reports