MEDIUMApt
Global

Turla Turns Kazuar Backdoor Into Modular P2P Botnet for Persistent Access

·Source: The Hacker News

Updated:

Executive Summary

The Russian state-sponsored hacking group known as Turla has transformed its custom backdoor Kazuar into a modular peer-to-peer (P2P) botnet that's engineered for stealth and persistent access to compromised hosts. Turla, per the U.S. Cybersecurity and Infrastructure Security Agency (CISA), is assessed to be affiliated with Center 16 of Russia's Federal Security Service (FSB)

Analysis

The Russian state-sponsored hacking group known as Turla has transformed its custom backdoor Kazuar into a modular peer-to-peer (P2P) botnet that's engineered for stealth and persistent access to compromised hosts. Turla, per the U.S. Cybersecurity and Infrastructure Security Agency (CISA), is assessed to be affiliated with Center 16 of Russia's Federal Security Service (FSB)
Source Attribution

Originally published by The Hacker News on May 15, 2026.

Related Threats

MEDIUMApt

Mustang Panda Linked to New Modular FDMTP Backdoor

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/mustang-panda-linked-to-new-modular-fdmtp-backdoor-image_small-10-a-31696.jpg" align=right hspace=4><b>Researchers Say Nation-State Actors Are Evolving Persistence Techniques</b><br>An apparent Chinese nation-state hacking group gussied up its tooling with new modular functionality, say security researchers who observed a cyberesp

Bank Info Security
MEDIUMApt

Mustang Panda Linked to Updated FDMTP Backdoor in Asia-Pacific Espionage Campaign

Mustang Panda campaign deploys updated FDMTP backdoor against Asia-Pacific and Japan networks

Infosecurity Magazine
MEDIUMApt

Ghostwriter Targets Ukrainian Government With Geofenced PDF Phishing, Cobalt Strike

The Belarus-aligned threat group known as Ghostwriter has been attributed to a fresh set of attacks targeting governmental organizations in Ukraine. Active since at least 2016, Ghostwriter has been linked to both cyber espionage and influence operations targeting neighboring countries, particularly Ukraine. It's also tracked under the monikers FrostyNeighbor, PUSHCHA, Storm-0257, TA445, UAC‑0057

The Hacker News