Gazer

MITRE ATT&CK: S0168 View on attack.mitre.org

Aliases: WhiteBear, Gazer

First seen
2016-01-01 00:00:00
Malware type
backdoor
Family
Malware family
Operating systems
windows
Related IoCs
1 (1 malicious)
Last IoC activity
2026-08-28 17:08:22
Profile updated
2026-07-07 15:45:21

Targeted industries: government-and-public-sector

Targeted regions: country_code:at country_code:no

Context

Gazer is a backdoor used by Turla since at least 2016.

Recent IoC activity

1 malicious indicator in Maltiverse are attributed to Gazer (S0168). The 1 most recently updated:

TypeIndicatorUpdatedSources
file sample c5db84fe0f762ebc2abe484d59d51fdf35a37f3a32e6f44d8197b1e8cda98e84 2026-08-28 2

Detection coverage

  • 1 YARA rules
  • 271 Sigma rules

Malware & tools used

  • Winlogon Helper DLL (attack-pattern)
  • Timestomp (attack-pattern)
  • Asymmetric Cryptography (attack-pattern)
  • Registry Run Keys / Startup Folder (attack-pattern)
  • Web Protocols (attack-pattern)
  • Shortcut Modification (attack-pattern)
  • File Deletion (attack-pattern)
  • Thread Execution Hijacking (attack-pattern)
  • Process Injection (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Symmetric Cryptography (attack-pattern)
  • Screensaver (attack-pattern)
  • Code Signing (attack-pattern)
  • System Owner/User Discovery (attack-pattern)
  • NTFS File Attributes (attack-pattern)
  • Encrypted/Encoded File (attack-pattern)
  • Scheduled Task (attack-pattern)
  • Mutual Exclusion (attack-pattern)

Used by threat actors

Detection rules

  • MALPEDIA_Win_Gazer_Auto (yara-rule)

Reports & references

  • Kaspersky — 81638 (report)
  • download.bitdefender.com — Bitdefender Whitepaper Pac A4 En En1 (report)
  • ESET — Eset Gazer (report)
  • ESET — Turla Crutch Keeping Back Door Open (report)
  • Kaspersky — 88069 (report)
  • pdfhost.io — F0@Qelmu2 Macprostorage 2017Finalbitdefenderwhitepapernetrepsera4En Enbitdefenderwhitepapernetrepsera4En Enindd (report)
  • cocomelonc.github.io — Malware Tricks 35 (report)
  • cocomelonc.github.io — Malware Pers 7 (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Gazer (report)
  • ESET — Eset Research Cyberespionage Gazer (report)
  • youtube.com — Watch (report)
  • cocomelonc.github.io — Malware Pers 2 (report)
  • github.com — Turla (report)
  • MITRE ATT&CK — S0168 (report)

External references