Malware

Kazuar

Indicators of Compromise 11

Domain abrargeospatial[.]ir Domain ekrn[.]ydns[.]eu Domain eset[.]ydns[.]eu Domain fjsconsultoria[.]com Domain hauptschule-schwalbenstrasse[.]de Domain ingas[.]rs Domain lucky-king-96d6[.]mopig92456[.]workers[.]dev Domain www[.]brannenburger-nagelfluh[.]de Domain www[.]pizzeria-mercy[.]de IP 64[.]176[.]173[.]164 IP 91[.]231[.]182[.]187

MITRE ATT&CK TTPs 17

T1012
Query Registry
Discovery
 T1036.005
Match Legitimate Name or Location
Defense Evasion
 T1057
Process Discovery
Discovery
 T1059.001
PowerShell
Execution
 T1071.001
Web Protocols
Command And Control
 T1082
System Information Discovery
Discovery
 T1083
File and Directory Discovery
Discovery
 T1102
Web Service
Command And Control
 T1140
Deobfuscate/Decode Files or Information
Defense Evasion
 T1480.001
Environmental Keying
Defense Evasion
 T1573.001
Symmetric Cryptography
Command And Control
 T1574.002
DLL Side-Loading
Persistence
 T1583.001
Domains
Resource Development
 T1583.004
Server
Resource Development
 T1583.007
Serverless
Resource Development
 T1584.003
Virtual Private Server
Resource Development
 T1608
Stage Capabilities
Resource Development

Source Articles

Gamaredon X Turla collab
ESET Research has uncovered the first known collaboration between two Russian FSB-affiliated APT groups, Gamaredon and Turla, targeting high-profile entities in Ukraine. Gamaredon provided initial access and infrastructure to Turla, enabling the deployment and reactivation of Turla's Kazuar backdoor on compromised systems. This cooperation suggests a strategic alignment between the two groups, with Gamaredon acting as an access provider for Turla's more targeted espionage operations.
welivesecurity