Malware
Kazuar
- First Reported
- Feb 15, 2024
- Latest Reported
- Jun 25, 2026
Reported Context (3)
- Used for ongoing cyber espionage, this backdoor shares significant code and functional overlaps with KAZUAR, a successful toolkit previously attributed to Turla. Google Details Turla’s STOCKSTAY Backdoor and Its Operations Against Ukrainian Targets
- and June 2025, Gamaredon tooling, including PteroGraphin and PteroOdd, was used to deploy Turla’s Kazuar backdoor and, in at least one case, restore Turla’s access after the group appeared to have lost its Researchers Link Gamaredon Activity to Turla Access in Ukraine
- the U.S., European Union, Ukraine and Asia. They’ve previously used malware families such as CAPIBAR and KAZUAR to target Ukrainian defense forces. After Crutch and TinyTurla, Turla has now expanded its arsenal to Turla Uses TinyTurla-NG Backdoor to Target Polish NGOs and Steal Password-Manager Key Material
CVE (1)
Malware (13)
People (8)
Threat Actors (6)
MITRE ATT&CK (29)
Vendors (4)
Products (17)
Tools (4)
Industries (5)
Countries (4)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.