Turla Turns Kazuar Backdoor Into Modular P2P Botnet for Persistent Access
Turla Turns Kazuar Backdoor Into Modular P2P Botnet for Persistent Access
https://thehackernews.com/2026/05/turla-turns-kazuar-backdoor-into.html
Publish Date: 2026-05-15 13:10:00
Source Domain: thehackernews.com
The Russian state-sponsored hacking group known as
Turla
has transformed its custom backdoor Kazuar into a modular peer-to-peer (P2P) botnet that’s engineered for stealth and persistent access to compromised hosts.
Turla, per the U.S. Cybersecurity and Infrastructure Security Agency (CISA), is assessed to be affiliated with Center 16 of Russia’s Federal Security Service (FSB). It overlaps with activity traced by the broader cybersecurity community under the names ATG26, Blue Python, Iron Hunter, Pensive Ursa, Secret Blizzard (formerly Krypton), Snake, SUMMIT, Uroburos, Venomous Bear, Waterbug, and WRAITH.
The hacking group is known for its attacks targeting government, diplomatic, and defense sectors in Europe and Central Asia, as well as
endpoints previously breached by Aqua Blizzard
(aka Actinium and Gamaredon) to support the Kremlin’s strategic objectives.
“This upgrade aligns with Secret Blizzard’s broader objective of gaining long-term access to systems for intelligence collection,” the Microsoft Threat Intelligence team
said
in a report published Thursday. “While many threat actors rely on increasing usage of native tools (living-off-the-land binaries (LOLBins)) to avoid detection, Kazuar’s progression into a modular bot highlights how Secret Blizzard is engineering resilience and stealth directly into their tooling.”
A key tool in Turla’s arsenal is
Kazuar
, a
sophisticated .NET backdoor
that has been consistently put to use since 2017. The latest findings from Microsoft charts its evolution from a “monolithic” framework into a modular bot ecosystem featuring three distinct component types, each with its own well-defined roles. These changes enable flexible configuration, reduce observable footprint, and facilitate broad tasking.
 |
| Overview of Kernel, Bridge, and Worker module interactions |
Attacks distributing the malware have been found to…
