قطاعة خضروات كهربائية
وفر 16%! اشترِ قطاعة خضروات كهربائية بسعر 219 د.ل فقط في ليبيا. متوفر حالياً، ال
🛒 تسوق الآنRussian Secret Blizzard Hackers Upgrade Kazuar Backdoor Into Modular P2P Botnet
Russian Secret Blizzard Hackers Upgrade Kazuar Backdoor Into Modular P2P Botnet
Microsoft researchers have revealed that the Russian state-sponsored hacking group Secret Blizzard has transformed its long-running Kazuar backdoor into a sophisticated modular peer-to-peer botnet, designed for stealthy long-term espionage against government and diplomatic targets across Europe, Asia, and Ukraine. The findings, published on May 14, 2026, expose a malware ecosystem that has been in continuous development since at least 2005.
Main Facts and Key Details
The upgraded Kazuar malware now operates using three distinct modules: Kernel, Bridge, and Worker. The Kernel module serves as the central coordinator, managing tasks, controlling other modules, and electing a single "leader" infected system within each compromised network. This leader is the only machine that communicates directly with the command-and-control server, while all other infected systems enter "silent" mode — dramatically reducing external traffic and evading detection.
The Bridge module acts as an external communications proxy, relaying traffic between the elected leader and remote C2 infrastructure using HTTP, WebSockets, or Exchange Web Services. Internal communications between modules rely on Windows Messaging, Mailslots, and named pipes, with all messages AES-encrypted and serialized using Google Protocol Buffers. The Worker module performs the actual espionage operations, including keylogging, screenshot capture, filesystem harvesting, system reconnaissance, email data collection, and stealing recent files.
Kazuar now supports 150 configuration options across eight functional categories, including communication and transport, execution and injection, security bypass, data exfiltration timing, task management, and file collection. The malware includes built-in bypasses for Antimalware Scan Interface (AMSI), Event Tracing for Windows (ETW), and Windows Lockdown Policy (WLDP), making it exceptionally difficult to detect using conventional security tools.
Reactions and Context
Microsoft emphasized that Secret Blizzard — whose activity overlaps with the Turla, Uroburos, and Venomous Bear groups and is linked to Russia's Federal Security Service (FSB) — typically seeks long-term persistence on target systems to exfiltrate politically significant documents and email content. The group has historically targeted government and diplomatic organizations, defense entities, and critical infrastructure.
"The Kernel leader is the one elected Kernel module that communicates with the Bridge module on behalf of the other Kernel modules, reducing visibility by avoiding large volumes of external traffic from multiple infected hosts," Microsoft explained in its security blog. The leader election process is fully autonomous, based on system uptime, reboot counts, and interruption metrics.
Security researchers from Unit 42 and independent analysts have previously documented Kazuar's evolution, noting its use in attacks against European government organizations in 2020 and against Ukraine in 2023. The malware's code lineage traces back over two decades, making it one of the longest-running nation-state cyber espionage tools still in active deployment.
Challenges and Outlook
Microsoft recommends that organizations focus on behavioral detection rather than static signatures, as Kazuar's modular and highly configurable architecture makes signature-based defenses largely ineffective. The malware's use of legitimate Windows IPC mechanisms and encrypted communications means it blends seamlessly with normal network operations.
The upgrade to a P2P architecture represents a significant escalation in nation-state cyber espionage capabilities, as it allows the botnet to remain operational even if individual nodes are discovered and removed. With 150 configuration options and multiple fallback channels for command and control, Kazuar demonstrates the level of investment and sophistication that state-sponsored actors continue to bring to bear against high-value targets.
Organizations in government, defense, diplomatic, and critical infrastructure sectors are urged to review their detection strategies, monitor for unusual IPC patterns, and implement behavioral analytics capable of identifying the subtle indicators of Kazuar's modular operations. As nation-state threats continue to evolve, the line between traditional malware and advanced persistent threats grows increasingly blurred.
