KazuarMalware
Kazuar is a fully featured, multi-platform backdoor Trojan written using the Microsoft. NET framework.From MITRE ATT&CK
Last reported yesterday, by The Hacker News3 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1003.001LSASS Memory
“Blindsight, a publicly available tool to dump LSASS memory with evasion techniques based on transactional NTFS”
- T1195Supply Chain Compromise
“Attacks leveraging supply chain compromise.”
- T1505.003Web Shell
“Deployment of backdoors via web shells, exploitation of vulnerable public-facing servers, or similar methods.”
- T1547.005Security Support Provider
“A custom tool dumping memory from its loading process, probably used as security support provider (SSP) to dump LSASS memory, detected as HackTool.Win64.MINIDUMP.ZALL”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack“…orking together to target and co-compromise Ukrainian entities, with one intrusion leveraging Gamaredon's PteroGraphin to deploy Turla's Kazuar backdoor.”
-
LABScon25 Replay | Gamaredon x Turla: Unveiling a 2025 Espionage Alliance Targeting Ukraine“…ss incidents observed between February and June 2025, Gamaredon tooling, including PteroGraphin and PteroOdd, was used to deploy Turla’s Kazuar backdoor and, in at least one case, restore Turla’s access after the group appeared to have lost its foothold.”
-
The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns“Based on the public reporting, it seems that PteroOdd and PteroPaste, two custom malware families attributed to Gamaredon, deployed Kazuar, a malware attributed to Turla.”
Indicators in its reports
named in the reports above- back-trust-aurora.cluster-ctrjumtpbmf.mnl-east-2.timcorpnet[.]comin 1 report
- afddd9d14453d4f9-1e185df7e4.ap-southeast-mnl.timcorpnet[.]comin 1 report
- 103.175.16[.]77in 1 report
- 45.92.158[.]50in 1 report
Copy these 4 indicators · defanged
Thanks — we review every report.