Gazer

Gazer is a second-stage backdoor malware written in C++ that was unveiled by Turla in August. It was discovered to have been deployed through watering-hole attacks and spear-phishing campaigns, enabling more precise targeting of victims. The malware is attributed to Pensive Ursa due to strong similarities in code and Tactics, Techniques, and Procedures (TTPs) with another backdoor from Pensive Ursa’s arsenal known as Gazer. A unique feature of this campaign was the insertion of video game-related sentences throughout the code, which added an additional layer of obfuscation. Moreover, Gazer's Command and Control (C&C) server was encrypted using Turla's own library for 3DES and RSA. Our analysis of Gazer was based on the Crutch dropper with SHA-1 A010D5449D29A1916827FDB443E3C84C405CB2A5 and the Gazer dropper with SHA-1 1AE4775EFF21FB59708E8C2B55967CD24840C8D9. These droppers were found to be similar to Gazer Win64/Agent.VX. The MITRE ATT&CK framework, a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations, was used to understand and classify the techniques employed in the Gazer campaigns. Despite its stealthiness, Gazer has plenty of similarities with previously used second-stage backdoors such as Carbon and Kazuar. These backdoors are believed to be recovery access tools used in case the main Turla backdoors, like Carbon or Gazer, are cleaned and operators can no longer access the compromised computers. This indicates a high level of sophistication and planning on the part of the attackers, demonstrating their preparedness for potential countermeasures.