Microsoft Details Turla’s Modular Kazuar P2P Botnet
Summary
Microsoft reports that Turla evolved Kazuar into a modular P2P botnet. Its Kernel, Bridge, and Worker modules coordinate tasks, communicate with command-and-control infrastructure, collect data, and support stealthy persistence.
Key points
- Microsoft describes Kazuar’s evolution from a monolithic backdoor into a modular botnet attributed to Turla, also known as Secret Blizzard.
- The Kernel coordinates tasks, configuration, logging, anti-analysis checks, and communication between modules.
- Kernel modules elect a leader through Mailslot; the leader requests tasks through the Bridge and directs Worker modules.
- The Bridge proxies communications between the Kernel leader and command-and-control infrastructure.
- Worker modules can log keystrokes, hook Windows events, and gather system information, file listings, and MAPI details.
- Pelmeni and ShadowLoader droppers are used to decrypt and launch Kazuar modules.
- Collected data is aggregated, encrypted, staged in a configured working directory, and then exfiltrated to the command-and-control server.
Article Details
- Attack Vectors
- Turla uses Pelmeni and ShadowLoader droppers to decrypt and launch Kazuar modules.
- Kazuar communicates with attacker-controlled infrastructure through Exchange Web Services, HTTP, and WebSockets.
- Kazuar collects keystrokes, Windows events, system information, file listings, and MAPI details, then stages collected data in a working directory for exfiltration to its C2 server.
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelKazuar sends collected task results and data from its working directory to its C2 server.T1056.001 · KeyloggingKazuar Worker modules log keystrokes.T1071.001 · Web ProtocolsKazuar uses HTTP and WebSockets to communicate with attacker-controlled infrastructure.T1074.001 · Local Data StagingKazuar stages collected data in a dedicated working directory on the compromised system before exfiltration.T1082 · System Information DiscoveryKazuar Worker modules gather system information.T1083 · File and Directory DiscoveryKazuar Worker modules gather file listings.T1497.001 · System ChecksKazuar's Kernel module performs anti-analysis and sandbox checks.
Threat Actors
Malware
KazuarTurla has evolved its Kazuar backdoor into a modular P2P botnet designed for stealth, persistence, and long-term access on compromised systems.PelmeniPelmeni and ShadowLoader help deploy the malware and support stealthy persistence.ShadowLoaderPelmeni and ShadowLoader help deploy the malware and support stealthy persistence.