Over the Kazuar’s Nest: Cracking Down on a Freshly Hatched Backdoor Used by Pensive Ursa (Aka Turla)
Summary: Unit 42 researchers documented a new, upgraded variant of Kazuar, an advanced .NET backdoor that Pensive Ursa (aka Turla, linked to the Russian FSB) typically uses as a second-stage payload, and which the Ukrainian CERT reported in July 2023 was targeting the Ukrainian defense sector. The variant, unseen in the wild since late 2020, fakes its compilation timestamp as November 20, 2008, supports 45 C2 commands versus 26 in the 2017 variant, and targets credential stores including Git source control and Signal.
Bottom line: A backdoor tied by code resemblance to Sunburst, developed continuously in secret for years and now carrying 45 commands aimed at source control and Signal data, is a direct threat to the developer and communications infrastructure a defense or government organization depends on.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026