Microsoft Uncovers Kazuar Malware’s Modular Architecture

Microsoft disclosed that Kazuar — attributed to the state-linked Secret Blizzard (FSB Center 16) — has evolved into a modular P2P botnet with Kernel, Bridge, and Worker modules enabling stealthy, persistent access to government and diplomatic systems across Europe, Central Asia, and Ukraine; delivery leverages a custom dropper and a lightweight .NET in-memory loader, internal communications are heavily encrypted, and the report includes SHA-256 indicators and guidance to hunt for behavioral anomalies such as internal message routing and leader-election activity.