Kazuar

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Malware family tracked by Malpedia. ID: win.kazuar

Threat Analysis

Kazuar is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

Intelligence Reports Mentioning Kazuar

Russian hackers turn Kazuar backdoor into modular P2P botnet

BleepingComputer· May 16, 2026

Turla Turns Kazuar Backdoor Into Modular P2P Botnet for Persistent Access

The Hacker News· May 15, 2026

Kazuar: Anatomy of a nation-state botnet

Microsoft Security Blog· May 14, 2026

External References

→http://researchcenter.paloaltonetworks.com/2017/05/unit42-kazuar-multiplatform-espionage-backdoor-api-access/

→https://cert.gov.ua/article/5213167

→https://r136a1.dev/2026/01/14/command-and-evade-turlas-kazuar-v3-loader/

→https://securelist.com/apt-trends-report-q1-2021/101967/

→https://securelist.com/it-threat-evolution-q2-2023/110355/

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

win.kazuarKazuar

External Intelligence

Malpedia: win.kazuar

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Kazuar