Gamaredon x Turla Kazuar Backdoor Second-Stage Deployment on Windows

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•4

Detects potential second-stage deployment of the Kazuar backdoor on Windows hosts, following initial access activity associated with the Gamaredon group (using Ptero-family implants). The rule monitors for a sequence involving PowerShell-based loaders (PteroPaste, PteroVDoor, PteroSetup, or PteroDee) followed by or combined with suspicious encoded PowerShell commands and the creation of Kazuar-specific named pipes or artifact markers.