Skip to content

Kazuar

Software · ATTACK:enterprise:S0265

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0265",
  "title": "Kazuar",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0265",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--536be338-e2ef-4a6b-afb6-8d5568b91eb2",
  "external_id": "S0265",
  "domain": "enterprise",
  "created": "2018-10-17T00:14:20.652Z",
  "modified": "2025-10-21T23:25:05.477Z",
  "version": "1.4",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Kazuar"
    },
    {
      "source_name": "Unit 42 Kazuar May 2017",
      "url": "https://researchcenter.paloaltonetworks.com/2017/05/unit42-kazuar-multiplatform-espionage-backdoor-api-access/"
    }
  ]
}

Explicit source assertions (32)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1cb54b2e-5f2d-4d1b-9fda-9b17f49de65b

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2286857e-ad96-4dda-abac-988e8cadda5c

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1485

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--333bd465-8713-4918-b60d-6128c52cbf04

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3872901c-9601-413e-bf8a-e2fe35772c71

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--464e688d-b243-4619-a60b-1be6e2d6a827

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--596f9132-84e2-42c9-ad58-8833fe38b1e6

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5e462e1b-62ec-4b44-990d-acd3f7b0010c

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--636be06a-5c19-45c8-b6be-c38634c583dc

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--719f0c42-8eb8-461b-8f35-cf5dfc42e47b

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75367678-910c-4715-9fc8-ee503f8e41e5

Accenture HyperStack October 2020

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0265

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--775d3c82-5863-43fa-8dfd-2f62382d53f1

Unit 42 Kazuar May 2017 · Talos TinyTurla September 2021

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--77bd9ea1-9401-4128-a78a-bd28d43a6c99

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--79852ad8-86ff-4747-97c0-1c7faa5fa69d

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a9e9275-44c2-40c9-9eb3-cafc54503874

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b2329e5-eacf-4626-bc3c-43331bc09aef

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7c44064a-f697-413c-b0b1-a6b92bf3cfc3

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--88ad4f5a-f127-435c-a8a0-6a6fceddfa47

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8bbf259b-029b-48fa-859b-5dbbbcd98b53

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9420f3cb-bd87-4dae-b8a7-0f1a5a14da55

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--950399e7-c9c2-4b53-bcc8-b99d0acba8d1

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--abf2b5db-184b-42af-bb52-e018977ca870

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--afa84fd1-e910-4bc7-8270-1e9f9b02b53f

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b2ae2606-fea8-4caf-a79e-91f09932d6d4

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c6c3192b-f541-4f19-b7b9-f2ad026c8ffb

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cfdffe47-f77b-46bb-8d7d-1753f5d74ff6

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--da11f44a-5af0-4b71-a049-a9ff85e2ba9b

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--df48ab06-0916-4d1d-9142-d0a508d0f0d4

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e4f09baa-2eae-445f-b000-5de3db07ad34

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e534bf54-5f9f-4d5f-bd9d-260e56da4951

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f1eaa7b9-4320-4549-aaa5-f992aad3ae1e

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fc572a1d-a44d-4588-b31d-1c54116d12f4

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fcd2604b-6954-4bd8-b0c6-22221b6dd1ce

Unit 42 Kazuar May 2017

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.