Gamaredon/Turla Kazuar: PowerShell Loader Chained Beacon to Second-Stage C2

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•4

Detects execution patterns associated with the Gamaredon group's spearphishing chains, specifically where PowerShell is invoked by common document or scripting applications (Winword, Excel, mshta, etc.) containing typical downloader flags (IEX, EncodedCommand). Additionally, it monitors for network connections from PowerShell to known dead-drop resolvers (e.g., telegra.ph, cloudflare workers) used by PteroOdd/Kazuar loaders.