Secret Blizzard, a group attributed to Russia by Microsoft, has evolved its Kazuar malware into a modular peer-to-peer (P2P) botnet designed for stealth, persistence, and intelligence gathering. Active since at least 2017, with roots tracing back to 2005, Kazuar is tied to the FSB-linked Turla group and has targeted government, diplomatic, and defense entities across Europe, Asia, and Ukraine. The latest version uses three (3) modules: a Kernel that coordinates operations and elects a single “leader” system to communicate with command-and-control (C2) infrastructure, a Bridge that handles external communications, and Workers that perform espionage tasks like keylogging, file theft, and email collection. By limiting external communication to one node and using encrypted internal messaging, Kazuar significantly reduces detection risk. With extensive configuration options and multiple security bypass techniques, Kazuar is highly adaptable, and CTIX Analysts recommend organizations implement behavioral detection over signature-based defenses for this reason.