LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0265: Kazuar

Kazuar is a fully featured, multi-platform backdoor Trojan written using the Microsoft .NET framework. [1]

EnterpriseS0265MalwareObject v1.4Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

Kazuar matters because ATT&CK describes it as a fully featured, multi-platform backdoor Trojan for Windows and macOS, with relationships showing discovery, command execution, collection, staging, command-and-control, and exfiltration-related behaviors. For leaders, the practical issue is not only “malware detection,” but whether the organization can prove it would notice a backdoor mapping users, files, processes, network settings, and local permissions before moving data or receiving further tools.

Executive priority

Treat this as a coverage-validation use case for endpoint, network, and incident response readiness across Windows and macOS. Priority questions: do we collect enough host and network evidence to reconstruct discovery and C2 activity; can the SOC distinguish legitimate administration from suspicious WMI, shell, and discovery behavior; and can IR quickly scope local data staging, tool transfer, and potential exfiltration paths? The ATT&CK relationship to Turla increases threat-intelligence relevance, but local exposure and prioritization should be based on observed telemetry and business-critical assets.

Technical view

Kazuar has no official ATT&CK detection text, so defenders should validate coverage through the related techniques rather than rely on a single signature. On Windows, prioritize visibility into .NET process behavior, WMI execution, command shell activity, DLL injection indicators, file deletion, local account/group discovery, process discovery, and file/directory enumeration. On macOS, validate Unix shell execution, user/system/network discovery, file discovery, local data collection, staging, and outbound C2-like traffic. Network teams should review visibility for web protocols, file transfer protocols, fallback channels, internal proxy behavior, bidirectional web-service communication, and ingress tool transfer. IR playbooks should connect host discovery events to possible local data staging and scheduled transfer/exfiltration patterns.

Likely telemetry

  • Endpoint process creation and command-line telemetry for Windows and macOS
  • Windows WMI activity and administrative execution logs
  • DLL/module load, process injection, and suspicious process access telemetry where available
  • File creation, modification, staging, and deletion events
  • Local account, group, user, process, system, network configuration, file, and directory discovery evidence

Detection direction

  • Map detections to the related ATT&CK techniques instead of treating Kazuar as a single malware signature, especially because official detection guidance is not provided.
  • Tune for sequences: discovery of users/processes/files/network settings followed by staging, outbound web or file-transfer traffic, tool transfer, or cleanup through file deletion.
  • Separate legitimate administration from suspicious use of WMI, Windows command shell, Unix shell, and local account/group discovery by baselining admin hosts, service accounts, timing, and target systems.
  • Validate Windows and macOS parity; the object is multi-platform, and endpoint visibility gaps on either platform can create blind spots.
  • Correlate host telemetry with network telemetry for web protocols, file transfer protocols, fallback channels, internal proxy behavior, and bidirectional web-service communication.

Mitigation priorities

  • Confirm endpoint protection, logging, and response capability on both Windows and macOS assets, especially high-value systems handling sensitive data.
  • Reduce abuse of administrative execution paths by controlling and monitoring WMI, command shells, privileged accounts, and local group membership.
  • Strengthen egress governance by monitoring and restricting unnecessary web, file-transfer, proxy, and external web-service communication paths.
  • Improve data-loss and incident-response readiness by monitoring local data staging locations, unusual scheduled transfers, and outbound transfer patterns.
  • Harden investigative retention: preserve endpoint, proxy, DNS, and firewall logs long enough to reconstruct discovery-to-exfiltration timelines.
Additional notes and limits

ATT&CK records Kazuar as software S0265 and describes it as a fully featured backdoor Trojan written with the Microsoft .NET framework. The relationship set links it to Turla and to techniques spanning execution, discovery, collection, command-and-control, exfiltration, stealth, and privilege-escalation-related behavior. The most useful defensive value is validating whether telemetry can connect these behaviors into an intrusion narrative rather than relying on a named-malware alert.

The supplied ATT&CK object does not provide official detection guidance, aliases, labels, or explicit tactics on the malware object itself. Technique descriptions are relationship context and include platforms broader than Kazuar’s listed Windows and macOS platforms, so defensive planning should not infer Kazuar platform support beyond Windows and macOS from those technique platform lists. Local environment baselines, asset criticality, and observed indicators are required for prioritization and incident conclusions.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Kazuar

Kazuar is a fully featured, multi-platform backdoor Trojan written using the Microsoft .NET framework. [1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

31 rows
DomainIDNameRelationship / procedure
EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

Kazuar adds a sub-key under several Registry run keys.[1]

EnterpriseT1105Ingress Tool Transfer

Kazuar downloads additional plug-ins to load on the victim’s machine, including the ability to upgrade and replace its own binary.[1]

EnterpriseT1485Data Destruction

Kazuar can overwrite files with random data before deleting them.[1]

EnterpriseT1070.004File DeletionSub-technique

Kazuar can delete files.[1]

EnterpriseT1027Obfuscated Files or Information

Kazuar is obfuscated using the open source ConfuserEx protector. Kazuar also obfuscates the name of created files/folders/mutexes and encrypts debug messages written to log files using the Rijndael cipher.[1]

EnterpriseT1132.001Standard EncodingSub-technique

Kazuar encodes communications to the C2 server in Base64.[1]

EnterpriseT1057Process Discovery

Kazuar obtains a list of running processes through WMI querying and the ps command.[1]

EnterpriseT1083File and Directory Discovery

Kazuar finds a specified directory, lists the files and metadata about those files.[1]

EnterpriseT1033System Owner/User Discovery

Kazuar gathers information on users.[1]

EnterpriseT1090.001Internal ProxySub-technique

Kazuar has used internal nodes on the compromised network for C2 communications.[2]

EnterpriseT1069.001Local GroupsSub-technique

Kazuar gathers information about local groups and members.[1]

EnterpriseT1125Video Capture

Kazuar captures images from the webcam.[1]

EnterpriseT1059.004Unix ShellSub-technique

Kazuar uses /bin/bash to execute commands on the victim’s machine.[1]

EnterpriseT1055.001Dynamic-link Library InjectionSub-technique

If running in a Windows environment, Kazuar saves a DLL to disk that is injected into the explorer.exe process to execute the payload. Kazuar can also be configured to inject and execute within specific processes.[1]

EnterpriseT1071.002File Transfer ProtocolsSub-technique

Kazuar uses FTP and FTPS to communicate with the C2 server.[1]

EnterpriseT1543.003Windows ServiceSub-technique

Kazuar can install itself as a new service.[1]

EnterpriseT1082System Information Discovery

Kazuar gathers information on the system.[1]

EnterpriseT1102.002Bidirectional CommunicationSub-technique

Kazuar has used compromised WordPress blogs as C2 servers.[1]

EnterpriseT1008Fallback Channels

Kazuar can accept multiple URLs for C2 servers.[1]

EnterpriseT1071.001Web ProtocolsSub-technique

Kazuar uses HTTP and HTTPS to communicate with the C2 server. Kazuar can also act as a webserver and listen for inbound HTTP requests through an exposed API.[1]

EnterpriseT1010Application Window Discovery

Kazuar gathers information about opened windows.[1]

EnterpriseT1113Screen Capture

Kazuar captures screenshots of the victim’s screen.[1]

EnterpriseT1029Scheduled Transfer

Kazuar can sleep for a specific time and be set to communicate at specific intervals.[1]

EnterpriseT1680Local Storage Discovery

Kazuar gathers information on local drives.[1]

EnterpriseT1087.001Local AccountSub-technique

Kazuar gathers information on local groups and members on the victim’s machine.[1]

EnterpriseT1074.001Local Data StagingSub-technique

Kazuar stages command output and collected data in files before exfiltration.[1]

EnterpriseT1005Data from Local System

Kazuar uploads files from a specified directory to the C2 server.[1]

EnterpriseT1016System Network Configuration Discovery

Kazuar gathers information about network adapters.[1]

EnterpriseT1047Windows Management Instrumentation

Kazuar obtains a list of running processes through WMI querying.[1]

EnterpriseT1547.009Shortcut ModificationSub-technique

Kazuar adds a .lnk file to the Windows startup folder.[1]

EnterpriseT1059.003Windows Command ShellSub-technique

Kazuar uses cmd.exe to execute commands on the victim’s machine.[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0010: Turla

Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos.[1][2][3][4][5]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1485: Data DestructionEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · TechniqueT1132.001: Standard EncodingEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1090.001: Internal ProxyEnterpriseuses · GroupG0010: TurlaEnterpriseuses · TechniqueT1069.001: Local GroupsEnterpriseuses · TechniqueT1125: Video CaptureEnterpriseuses · TechniqueT1059.004: Unix ShellEnterpriseuses · TechniqueT1055.001: Dynamic-link Library InjectionEnterpriseuses · TechniqueT1071.002: File Transfer ProtocolsEnterpriseuses · TechniqueT1543.003: Windows ServiceEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1102.002: Bidirectional CommunicationEnterpriseuses · TechniqueT1008: Fallback ChannelsEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1010: Application Window DiscoveryEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1029: Scheduled TransferEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.4
Created
Modified
Raw hash
bbff460f30d56e3a...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.4Current bundlebbff460f30d5…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  2. [2]
    Accenture HyperStack October 2020

    Accenture. (2020, October). Turla uses HyperStack, Carbon, and Kazuar to compromise government entity. Retrieved December 2, 2020.

    Open source URL
  3. [3]
    Talos TinyTurla September 2021

    Cisco Talos. (2021, September 21). TinyTurla - Turla deploys new malware to keep a secret backdoor on victim machines. Retrieved December 2, 2021.

    Open source URL
  4. [4]
    Kazuar

    (Citation: Unit 42 Kazuar May 2017)

  5. [5]
    Kazuar

    (Citation: Unit 42 Kazuar May 2017)

  6. [6]
    Kazuar

    (Citation: Unit 42 Kazuar May 2017)

  7. [7]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  8. [8]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  9. [9]
    mitre-attackS0265
    Open source URL
  10. [10]
    mitre-attackS0265
    Open source URL
  11. [11]
    mitre-attackS0265
    Open source URL
  12. [12]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  13. [13]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  14. [14]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  15. [15]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  16. [16]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  17. [17]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  18. [18]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  19. [19]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  20. [20]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  21. [21]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  22. [22]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  23. [23]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  24. [24]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  25. [25]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  26. [26]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  27. [27]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  28. [28]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  29. [29]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  30. [30]
    Accenture HyperStack October 2020

    Accenture. (2020, October). Turla uses HyperStack, Carbon, and Kazuar to compromise government entity. Retrieved December 2, 2020.

    Open source URL
  31. [31]
    Talos TinyTurla September 2021

    Cisco Talos. (2021, September 21). TinyTurla - Turla deploys new malware to keep a secret backdoor on victim machines. Retrieved December 2, 2021.

    Open source URL
  32. [32]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  33. [33]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  34. [34]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  35. [35]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  36. [36]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  37. [37]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  38. [38]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  39. [39]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  40. [40]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  41. [41]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  42. [42]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  43. [43]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  44. [44]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  45. [45]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  46. [46]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  47. [47]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  48. [48]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  49. [49]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  50. [50]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  51. [51]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  52. [52]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  53. [53]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  54. [54]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  55. [55]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  56. [56]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  57. [57]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  58. [58]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  59. [59]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  60. [60]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  61. [61]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  62. [62]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  63. [63]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  64. [64]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  65. [65]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  66. [66]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  67. [67]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  68. [68]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  69. [69]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use