Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Zero Day Initiative

Cisco Talos

Krebs on Security

Palo Alto Unit 42

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Turla's Kazuar v3 loader employs sophisticated techniques to evade detection. It uses a VBScript to drop files and execute a native loader, which bypasses security measures and leverages COM for stealth. The loader utilizes control flow redirection, patchless ETW and AMSI bypasses, and COM integration to decrypt and execute three Kazuar v3 payloads (KERNEL, WORKER, BRIDGE) in memory. The attack chain is designed to be resilient and stealthy, exploiting trusted system processes to avoid detection. The malware uses modular architecture and COM subsystem integration to maintain a low profile while carrying out its malicious activities.

Turla's Kazuar v3 loader represents an evolution in malware loader design, employing multiple sophisticated techniques to evade detection and maintain persistence. The attack begins with a VBScript that drops files and executes a native loader, leveraging the Component Object Model (COM) for stealthy operations. This loader uses control flow redirection to complicate analysis and detection. It implements patchless bypasses of Event Tracing for Windows (ETW) and Antimalware Scan Interface (AMSI), allowing it to evade common Windows security monitoring and scanning tools without modifying system binaries. The loader decrypts and executes three distinct Kazuar v3 payloads—KERNEL, WORKER, and BRIDGE—entirely in memory, avoiding disk writes that would trigger traditional antivirus detection. The modular architecture allows flexible, multi-stage payload deployment, while COM subsystem integration exploits trusted system processes to blend malicious activity with legitimate operations. This design enhances resilience and stealth, complicating detection and forensic analysis. Indicators include multiple file hashes, IP addresses, URLs, and domains linked to the malware infrastructure. Although no active exploits are currently reported in the wild, the threat actor Turla is known for targeted espionage campaigns, suggesting potential use against high-value targets. The malware’s techniques align with MITRE ATT&CK tactics such as T1218.011 (Signed Binary Proxy Execution: Regsvr32), T1056.001 (Input Capture: Keylogging), T1140 (Deobfuscate/Decode Files or Information), and others related to evasion and persistence.

Detailed information about Command & Evade: Turla's Kazuar v3 Loader. Get real-time updates, technical details, and mitigation strategies.

Command & Evade: Turla's Kazuar v3 Loader - Live Threat Intelligence - Threat Radar | OffSeq.com

Command & Evade: Turla's Kazuar v3 Loader

Threats Tagged 'etw bypass'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'etw bypass'

Lead Pen Test Professional