Command & Evade: Turla's Kazuar v3 Loader

Turla's Kazuar v3 loader employs sophisticated techniques to evade detection. It uses a VBScript to drop files and execute a native loader, which bypasses security measures and leverages COM for stealth. The loader utilizes control flow redirection, patchless ETW and AMSI bypasses, and COM integration to decrypt and execute three Kazuar v3 payloads (KERNEL, WORKER, BRIDGE) in memory. The attack chain is designed to be resilient and stealthy, exploiting trusted system processes to avoid detection. The malware uses modular architecture and COM subsystem integration to maintain a low profile while carrying out its malicious activities.

• Inside DesckVB Rat Analysis: From Malspam to In-Memory RATMalware2026-06-03
• The Gentlemen ransomware: Dissecting a self-propagating Go encryptorMalware2026-05-28
• Kazuar: Anatomy of a nation-state botnetMalware2026-05-14
• From Invitation to Infection: How SILENTCONNECT Delivers ScreenConnectMalware2026-03-19
• 2CLoader: A New Malware Loader Delivering Vidar and RemusMalware2026-09-30