Article
Turla APT: Russia’s Longstanding Cyber Espionage Powerhouse
Turla profile: aliases such as Snake, Uroburos and Secret Blizzard, active since the early 2000s, modular malware including Kazuar, and typical targets.
Read more
Malware profile
Kazuar
Also known as Kazuar v2, KazuarV2, Kazuar v3
Kazuar is a backdoor Trojan that runs on Windows and macOS.
In short
Kazuar is a backdoor Trojan that runs on Windows and macOS. MITRE ATT&CK describes it as fully featured and written in .NET. MITRE lists the Turla group as a user, and CERT-EU reported in 2024 and 2025 that Turla used versions of it against targets in Ukraine.
- Names4names in public reportsKazuar · Kazuar v2 · KazuarV2
- Techniques20ATT&CK techniques listedCommand and Control · Execution · Stealth
- Linked Groups1groups that use itTurla
In one minute
- What it is
- A backdoor Trojan for Windows and macOS, described by MITRE as fully featured and multi-platform.
- What it does
- Runs commands, finds and collects files, takes screenshots and webcam images, and sends data to a command server.
- Who uses it
- MITRE lists the Turla group as a user, and says Turla is attributed to Russia's FSB. CERT-EU, in December 2024 and September 2025 briefs, reports Turla using Kazuar in Ukraine.
- How it gets in
- CERT-EU reports spearphishing with Amadey bots in one case, and Gamaredon tools restarting Kazuar v3 in another.
- What to do first
- Check Windows machines for new services, Run keys and startup shortcuts, and watch outbound web traffic for odd command servers.
What it does
Kazuar gives an attacker remote control of an infected computer. MITRE says it can run commands, collect and stage files, take screenshots and webcam images, and send data to a command server over web and file transfer protocols.
It has also been reported in several versions. CERT-EU names Kazuar v2 and v3 in its September 2025 brief.
MITRE ATT&CK also lists another Turla tool, the Snake implant, which has its own profile: Snake (Uroburos).
Names
Public sources use several names for this malware.
| Name | Where it appears |
|---|---|
| Kazuar | MITRE ATT&CK software S0265[1] |
| Kazuar v2 | Name used in CERT-EU Cyber Brief 25-10 for a version of the backdoor[4] |
| KazuarV2 | Spelling used in CERT-EU Cyber Brief 25-01[3] |
| Kazuar v3 | Name used in CERT-EU Cyber Brief 25-10 for a later version[4] |
What it can do
What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.
Command and Control
Application Layer Protocol: Web Protocols T1071.001
It talks to its command server over HTTP and HTTPS, and can also listen for incoming HTTP requests through an exposed API.[1]
Application Layer Protocol: File Transfer Protocols T1071.002
It can also reach its command server over FTP and FTPS.[1]
Fallback Channels T1008
It can accept more than one URL for its command servers.[1]
Web Service: Bidirectional Communication T1102.002
It has used compromised WordPress blogs as command servers.[1]
Ingress Tool Transfer T1105
It downloads extra plug-ins to run on the victim machine and can replace its own binary with a newer one.[1]
Data Encoding: Standard Encoding T1132.001
It encodes its traffic to the command server in Base64.[1]
Execution
Stealth
Process Injection: Dynamic-link Library Injection T1055.001
On Windows it saves a DLL to disk that is injected into explorer.exe to run its payload, and it can be set to inject into other chosen processes.[1]
Obfuscated Files or Information T1027
It is obfuscated with the open source ConfuserEx protector, hides the names of files, folders and mutexes it creates, and encrypts its log messages.[1]
Persistence
Create or Modify System Process: Windows Service T1543.003
It can install itself as a new Windows service.[1]
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1547.001
It adds a sub-key under several Registry run keys.[1]
Boot or Logon Autostart Execution: Shortcut Modification T1547.009
It adds a .lnk file to the Windows startup folder.[1]
Collection
Discovery
How it spreads
The sources do not give a full infection route. CERT-EU reported in December 2024 that Turla used spearphishing and Amadey bots to deploy KazuarV2 on Ukrainian military devices. In September 2025 it reported that Gamaredon tools were used to restart Turla's Kazuar v3 backdoor and to deploy Kazuar v2 on select machines in Ukraine.
Timeline
- May 09, 2023
Joint advisory on Turla's Snake malware
CISA and partners published an advisory on the Snake implant, which they say is used by a unit within Center 16 of Russia's FSB that also operates the wider Turla toolset. The advisory is about Snake and does not name Kazuar.[10]
- December 2024
CERT-EU reports KazuarV2 in Ukraine
CERT-EU Cyber Brief 25-01 says Turla used spearphishing and Amadey bots to deploy Tavdig and KazuarV2 backdoors on Ukrainian military devices.[3]
- September 2025
CERT-EU reports Gamaredon and Turla cooperation
CERT-EU Cyber Brief 25-10 says Gamaredon tools were used to restart Turla's Kazuar v3 and to deploy Kazuar v2 on select machines in Ukraine.[4]
Who uses it
Detection and defense
Questions
What is Kazuar?
MITRE ATT&CK describes Kazuar as a fully featured, multi-platform backdoor Trojan. MITRE lists Windows and macOS as platforms.
Who uses Kazuar?
MITRE lists the Turla group as a user and says Turla is attributed to Russia's FSB. CERT-EU reported Turla using Kazuar in Ukraine in its December 2024 and September 2025 briefs.
What can Kazuar do?
MITRE lists running commands through the shell, collecting files, screenshots, webcam capture, plug-in downloads and overwriting files before deleting them.
Is Kazuar still in use?
CERT-EU reported Kazuar v2 and v3 in attacks on Ukraine in its December 2024 and September 2025 Cyber Briefs.
In our research
Sources
- Kazuar, Software S0265 MITRE ATT&CKSupports: Description, platforms, techniques with use sentences, Turla as a user group.
- Turla, Group G0010 MITRE ATT&CKSupports: Turla attributed to Russia's FSB, active since at least 2004, lists Kazuar.
- CERT-EU Cyber Brief 25-01, December 2024 CERT-EUSupports: Turla deploying KazuarV2 on Ukrainian military devices.
- CERT-EU Cyber Brief 25-10, September 2025 CERT-EUSupports: Gamaredon tools restarting Kazuar v3 and deploying Kazuar v2 for Turla.
- Process Injection: Dynamic-link Library Injection, T1055.001 MITRE ATT&CKSupports: Mitigation M1040, behaviour prevention on endpoint.
- Application Layer Protocol: Web Protocols, T1071.001 MITRE ATT&CKSupports: Mitigations M1037 and M1031 for web command traffic.
- Create or Modify System Process: Windows Service, T1543.003 MITRE ATT&CKSupports: Mitigation M1047, audit.
- Obfuscated Files or Information, T1027 MITRE ATT&CKSupports: Mitigations M1049 and M1040 against obfuscated payloads.
- Command and Scripting Interpreter: Windows Command Shell, T1059.003 MITRE ATT&CKSupports: Mitigation M1038, execution prevention.
- Hunting Russian Intelligence "Snake" Malware, AA23-129A CISASupports: 9 May 2023 advisory; Snake attributed to a unit in FSB Center 16 that operates the Turla toolset. Does not name Kazuar.
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.