Kazuar: Multiplatform Espionage Backdoor with API Access
Summary: Unit 42 researchers documented Kazuar, a .NET Framework backdoor Trojan with a full command set and a plugin framework that lets operators remotely load additional .NET applications, and found code paths suggesting a Mac or Unix variant may also exist. The tool exposes its commands through an API on a built-in webserver via a 'remote' command, flipping communication so the C2 server sends HTTP requests directly to the Trojan, and its known C2 servers are all compromised WordPress blogs.
Key Takeaway: Unit 42 suspects Kazuar is linked to Turla, a group reported to have compromised embassies, defense contractors, educational institutions and research organizations, and whose code lineage traces back to at least 2005 - meaning an operator with a two-decade track record may now have a backdoor that accepts inbound commands on your own server.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026