Kazuar

MITRE ATT&CK: S0265 View on attack.mitre.org

Aliases: Kazuar

First seen
2015-12-01 00:00:00
Malware type
backdoor, trojan
Family
Malware family
Operating systems
windows, macos
Related IoCs
4 (4 malicious)
Last IoC activity
2026-09-01 16:36:59
Profile updated
2026-07-07 12:44:13

Targeted industries: government-and-public-sector energy-and-utilities

Context

Kazuar is a fully featured, multi-platform backdoor Trojan written using the Microsoft .NET framework.

Recent IoC activity

4 malicious indicators in Maltiverse are attributed to Kazuar (S0265). The 4 most recently updated:

TypeIndicatorUpdatedSources
hostname hcdh-tunisie.org 2026-09-02 2
file sample 436cfce71290c2fc2f2c362541db68ced6847c66a73b55487e5e5c73b0636c85 2026-06-03 3
file sample 78aaeff421355a794a6248c84871eef7.exe 2026-05-19 3
file sample bd7d85741a3801d8fe7a725061249337.exe 2026-05-19 3

Detection coverage

  • 4 YARA rules
  • 556 Sigma rules

Malware & tools used

  • Registry Run Keys / Startup Folder (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Data Destruction (attack-pattern)
  • File Deletion (attack-pattern)
  • Obfuscated Files or Information (attack-pattern)
  • Standard Encoding (attack-pattern)
  • Process Discovery (attack-pattern)
  • File and Directory Discovery (attack-pattern)
  • System Owner/User Discovery (attack-pattern)
  • Internal Proxy (attack-pattern)
  • Local Groups (attack-pattern)
  • Video Capture (attack-pattern)
  • Unix Shell (attack-pattern)
  • Dynamic-link Library Injection (attack-pattern)
  • File Transfer Protocols (attack-pattern)
  • Windows Service (attack-pattern)
  • System Information Discovery (attack-pattern)
  • Bidirectional Communication (attack-pattern)
  • Fallback Channels (attack-pattern)
  • Web Protocols (attack-pattern)
  • Application Window Discovery (attack-pattern)
  • Screen Capture (attack-pattern)
  • Scheduled Transfer (attack-pattern)
  • Local Storage Discovery (attack-pattern)
  • Local Account (attack-pattern)

Used by threat actors

Detection rules

  • SEKOIA_Apt_Turla_Kazuar_Variant_2023 (yara-rule)
  • SIGNATURE_BASE_Apt_RU_Turla_Kazuar_Debugview_Pefeatures (yara-rule)
  • SIGNATURE_BASE_APT_MAL_RU_Turla_Kazuar_May20_1 (yara-rule)
  • MALPEDIA_Win_Kazuar_Auto (yara-rule)

Reports & references

  • r136a1.dev — Command And Evade Turlas Kazuar V3 Loader (report)
  • pwc.co.uk — Cyber Threats 2019 Retrospect (report)
  • Kaspersky — 110355 (report)
  • Kaspersky — 109552 (report)
  • Microsoft — Frequent Freeloader Part Ii Russian Actor Secret Blizzard Using Tools Of Other Groups To Attack Ukraine (report)
  • Kaspersky — 101967 (report)
  • picussecurity.com — Picus 10 Critical Mitre Attck Techniques T1055 Process Injection (report)
  • accenture.com — Turla Belugasturgeon Compromises Government Entity (report)
  • CERT-UA — 5213167 (report)
  • twitter.com — 1681695399084539908 (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Kazuar (report)
  • Palo Alto Unit 42 — Pensive Ursa Uses Upgraded Kazuar Backdoor (report)
  • Kaspersky — 99981 (report)
  • researchcenter.paloaltonetworks.com — Unit42 Kazuar Multiplatform Espionage Backdoor Api Access (report)
  • epicturla.com — Sysinturla (report)
  • youtu.be — Sw8Kvkwdorc (report)
  • MITRE ATT&CK — S0265 (report)
  • researchcenter.paloaltonetworks.com — Unit42 Kazuar Multiplatform Espionage Backdoor Api Access (report)

External references