Turla Turns Kazuar Backdoor Into Modular P2P Botnet for Persistent Access

Russian state-sponsored hacking group Turla has evolved its Kazuar backdoor into a modular P2P botnet for stealth and persistent access.

• •The botnet features three module types: Kernel (coordinator), Bridge (C2 proxy), and Worker (data collection and keystroke logging)
• •Kernel modules elect a leader based on runtime duration divided by interrupts like reboots, ensuring a single point of C2 communication
• •Multiple internal communication methods are used: Windows Messaging, Mailslot, and named pipes for inter-module communication
• •External communication uses three different protocols: Exchange Web Services, HTTP, and WebSockets
• •A centralized working directory stages and organizes collected data by function before exfiltration