Kazuar: Multiplatform Espionage Backdoor with API Access - Palo Alto Networks Blog

This report analyzes Kazuar, a .NET espionage backdoor that exposes an API for command and control, supports plugins, and can run on Windows as well as Unix-like systems. It details its persistence mechanisms (startup and registry-based), a multi-protocol C2 channel (primarily HTTP), and a broad command set, including remote commands and a plugin framework, with possible ties to the Turla threat group and related infrastructure.