Turla Turns Kazuar Backdoor Into Modular P2P Botnet for Persistent Access

Microsoft and industry reporting describe Turla (Secret Blizzard), a Russia-linked APT, transforming the Kazuar .NET backdoor into a modular P2P botnet comprising Kernel, Bridge, and Worker modules to enable stealthy, resilient long-term access to government, diplomatic, and defense targets; the architecture uses multiple inter-module channels and external communication methods, stages data in a dedicated working directory for encrypted exfiltration, and is deployed via droppers such as Pelmeni and ShadowLoader.