Loading story…
Microsoft reported that Kazuar, a malware family attributed to the Russian state actor Secret Blizzard, has evolved from a conventional backdoor into a modular peer-to-peer botnet built for long-term espionage. The company said the malware now operates through three coordinated components—Kernel, Bridge, and Worker—that divide command-and-control, internal relay, and task execution functions to reduce visible network traffic and improve resilience. According to the report, Kazuar can communicate over HTTP, WebSockets, or Exchange Web Services, uses anti-analysis checks, stores encrypted staging data locally, and employs a leader-election mechanism so only one Kernel node communicates externally for the wider botnet.
Microsoft said Kazuar is delivered through droppers including Pelmeni and is tied to Secret Blizzard, which it links to Russia’s FSB Center 16. The malware has been associated with espionage targeting of government and diplomatic organizations in Europe, Central Asia, and Ukraine, reflecting a focus on stealthy persistence rather than disruptive attacks. Microsoft published mitigations, Microsoft Defender detections, and sample indicators of compromise to help defenders identify and contain infections tied to the botnet.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Microsoft published an analysis describing Kazuar as a long-evolving malware family attributed to the Russian state actor Secret Blizzard, now operating as a modular peer-to-peer botnet for stealthy long-term espionage. The report outlined its Kernel, Bridge, and Worker modules, delivery via droppers such as Pelmeni, anti-analysis features, resilient command-and-control methods, and provided detections, mitigations, and indicators of compromise.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 17 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
7 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourceblog.polyswarm.io
Open sourcebleepingcomputer.com
Open sourcethehackernews.com
Open sourcemicrosoft.com
Open sourcemalpedia.caad.fkie.fraunhofer.de
Open sourcegist.github.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Earth Baku, a cluster linked to **APT41**, has expanded a long-running cyberespionage campaign against government and enterprise targets from the Indo-Pacific into **Europe** and the **Middle East and Africa**, using a steadily evolving malware arsenal and multiple intrusion paths. Trend Micro reported the group has compromised organizations in sectors including airlines, automotive, infrastructure, media, publishing, IT, and hardware, with activity tied to **SQL injection** on public-facing applications, exploitation of **Microsoft Exchange ProxyLogon** `CVE-2021-26855`, IIS server abuse, and web shells including **China Chopper** and **Godzilla**. Earlier reporting also described possible email-delivered LNK downloader chains and continued operational activity after public law-enforcement scrutiny. The operators have introduced **StealthReacher**, an upgraded loader derived from **StealthVector**, to deploy **SneakCross**, a modular backdoor assessed as the successor to **ScrambleCross** and earlier **Crosswalk**-related tooling. Across reporting, the group was observed using **Cobalt Strike Beacon**, **ShadowPad**, **Natwalk**, **RBRAT**, **Errorroot**, **HIGHNOON**, and other loaders and backdoors, while relying on stealth techniques such as ETW disabling, process and DLL hollowing, module stomping, CFG bypass, early-bird injection, and certificate bypass. Researchers also said Earth Baku hid command-and-control through CDN services, **Cloudflare Workers**, and **Google services**, and supported persistence, tunneling, and exfiltration with customized **iox**, **Rakshasa**, **Tailscale**, and **MEGAcmd**.
Aug 15, 2026
SentinelLabs reported that a **Zebrocy** campaign linked to **Sofacy/APT28** targeted organizations in Kazakhstan with malicious Microsoft Word documents masquerading as materials from **Kazchrome**. The lure files carried the same VBA macro, which decoded a base64-encoded Delphi payload named `wininition.exe`; once executed, the malware acted as a keylogger by installing a low-level keyboard hook. Two of the six analyzed documents were likely uploaded to VirusTotal from Kazakhstan by victims, indicating the lures were opened in the intended geography. The investigation identified two likely compromised domains used as command-and-control infrastructure and tied the activity to Zebrocy’s established tradecraft. SentinelLabs also documented methods for reversing the password-protected VBA macros and analyzing the Delphi malware with tools including **IDR** and **Ghidra**, and published hashes, URLs, and **YARA** rules to support detection and threat hunting for related intrusions.
Jun 29, 2026
Multiple reports detailed **state-linked intrusion activity** relying on social engineering and trusted delivery mechanisms to gain initial access and establish remote control. Researchers reported a suspected state-affiliated espionage operation targeting government and financial organizations in **Kazakhstan and Afghanistan**, built around a previously unreported Windows DLL implant dubbed **KazakRAT** delivered via malicious `MSI` installers and decoy documents (e.g., a fake Kazakh presidential letter and an Afghan provincial memo). The malware was described as relatively unsophisticated—unencrypted HTTP beaconing and minimal obfuscation—yet capable of host reconnaissance, file search/exfiltration, and downloading/executing additional payloads, enabling long-running access since at least 2022. Separately, Insikt Group described **North Korean** operators (tracked as **PurpleBravo**) running the “**Contagious Interview**” campaign, using fake recruiter personas and weaponized “coding tests” hosted on platforms like GitHub to trick software developers into executing malware on corporate devices, supporting software supply-chain targeting. The toolset reportedly includes **BeaverTail** (JavaScript infostealer) and newly identified RATs **PylangGhost** and **GolangGhost**. In another supply-chain style incident, Trend research and an Emurasoft advisory reported the **official EmEditor download** being tampered with to serve a trojanized `MSI` whose `CustomAction` launched PowerShell to fetch staged payloads from lookalike domains (e.g., `EmEditorjp[.]com`, `EmEditorgb[.]com`, `EmEditorde[.]com`), followed by environment fingerprinting and geofencing checks—highlighting ongoing risk from compromised public software distribution channels.
Jun 29, 2026