Turla Turns Kazuar Backdoor Into Modular P2P Botnet for Persistent Access
2026-05-16T13:24:07Z•69ec4f2f0bf3a5011dffbf3fc0f8ca1feef507ac35b870c79af030bb8417b294
active-exploitationcisa-kevcisco-sd-wanclaw-chaineximfragnesiagemstufferkazuarlinux-kernelmicrosoft-exchangenginxnode-ipcopenaiopenclawp2p-botnetpraisionairubyGemssupply-chaintanstackturlazero-day
What happened
This feed contains a high-volume security roundup (mid‑May 2026) highlighting multiple high‑risk incidents and disclosures: Russian-linked Turla has reworked the Kazuar backdoor into a modular P2P botnet for persistent stealthy access; four OpenClaw vulnerabilities ("Claw Chain") can be chained for data theft, privilege escalation and persistence; a TanStack supply‑chain compromise (Mini Shai‑Hulud) impacted two OpenAI employee devices; Microsoft Exchange on‑prem CVE-2026-42897 is being exploited via crafted email; a critical authentication‑bypass in Cisco Catalyst SD‑WAN Controller (CVE-2026-
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 69ec4f2f0bf3a5011dffbf3fc0f8ca1feef507ac35b870c79af030bb8417b294
- Enrichment time
- 2026-05-16T13:24:07Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.