Turla__2017__eset-gazer.pdf

Detailed analysis of Gazer, Turla's second-stage backdoor, covering its loader and orchestrator architecture, custom encryption, persistence techniques, communications, and task/response flow; it notes Gazer's deployment against embassies and ministries, its evolution across versions, and the use of compromised websites as C&C proxies, highlighting the sophistication and ongoing development of this Turla threat.