H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Gazer](https://attack.mitre.org/software/S0168) is a backdoor used by [Turla](https://attack.mitre.org/groups/G0010) since at least 2016. (Citation: ESET Gazer Aug 2017)

Labels

malware

19 recorded

Relationships

uses

to Asymmetric Cryptography

Technique

uses

to Code Signing

Technique

uses

to Encrypted/Encoded File

Technique

uses

to File Deletion

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Mutual Exclusion

Technique

uses

to NTFS File Attributes

Technique

uses

to Process Injection

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Scheduled Task

Technique

uses

to Screensaver

Technique

uses

to Shortcut Modification

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Owner/User Discovery

Technique

uses

to Thread Execution Hijacking

Technique

uses

to Timestomp

Technique

uses

to Web Protocols

Technique

uses

to Winlogon Helper DLL

Technique

uses

from Turla

Group

6 external

References

mitre-attack

S0168

open

Gazer

—

ESET Gazer Aug 2017

https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf

open

ESET Crutch December 2020

https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/

open

Securelist WhiteBear Aug 2017

https://securelist.com/introducing-whitebear/81638/

open

WhiteBear

—