Turla Upgrades Kazuar Backdoor to Resilient P2P Botnet Targeting Governments

·1 views

Microsoft's Security Blog published a detailed analysis on May 14, 2026, revealing that Turla, a Russian FSB-linked state-sponsored hacking group, has significantly upgraded its Kazuar backdoor. The malware, in use since at least 2017, has been transformed from a traditional command-and-control backdoor into a modular peer-to-peer botnet with no single point of failure. The upgraded variant supports dynamically loaded plugins for credential theft, lateral movement, and data exfiltration, while using encrypted custom protocols and legitimate system tools to evade detection. Primary targets include government ministries, diplomatic missions, and defense organizations across Europe and Central Asia. Researchers from Palo Alto Networks' Unit 42 and SecurityAffairs noted the P2P architecture is deliberately designed for long-term resilience, allowing the botnet to persist even after partial remediation by defenders.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Heym's Agentic Kanban Board Aims to Bring Transparency to Multi-Agent AI Systems

A platform called Heym is attempting to address a core challenge in multi-agent AI systems: the lack of visibility into what each agent does, why processes stall, and where outputs go. Heym introduces an 'Agentic Kanban Board' where moving a card between columns triggers automated AI workflow chains rather than simply updating a status. Each card carries accumulated context — including original requests, human feedback, file attachments, and prior workflow outputs — so agents at every stage share a common memory without manual prompt engineering. Workflows are arranged on a visual canvas, making control flow, tool usage, approvals, and execution states inspectable by both technical and non-technical team members. The system uses colour-coded card states to communicate whether a workflow is running, awaiting human input, completed, or failed.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer fixes off-grid price validation bug in Polymarket's Python SDK

A developer auditing Polymarket's open-source Python SDK, py-sdk, discovered a bug in the order validation logic that incorrectly checks decimal place count instead of verifying whether a price is an actual multiple of the market's tick size. The flaw affects half-step tick sizes of 0.005 and 0.0025, allowing off-grid prices like 0.007 to pass client-side validation even though they would ultimately be rejected by the exchange. Because Polymarket orders are signed using EIP-712 and the price is embedded in the signature, the exchange cannot adjust an off-grid price without invalidating the signature, making the failed signing round-trip entirely avoidable. The fix, an eight-line additive patch adding a modulo-based grid membership check to both validator functions, was submitted as a pull request and reported upstream to Polymarket's repository. The patch was verified against approximately 23,000 enumerated price cases across all supported tick sizes, with no false rejections or false acceptances recorded.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How One Team Fixed Race Conditions Caused by Duplicate Webhook Deliveries

An engineering team discovered a critical race condition in production after duplicate webhooks bypassed application-level checks and left their database in an inconsistent state. The problem stemmed from multiple container instances simultaneously processing identical events, both passing validation and writing to the database at the same time. To resolve this, the team implemented an Idempotent Consumer Pattern using two defensive layers: a Redis distributed lock using the atomic SETNX command with a 30-second TTL, and a unique-constraint-backed idempotency keys table in their relational database. The database layer ensures that any duplicate slipping past Redis triggers a UniqueConstraintViolationException and rolls back the entire transaction atomically. Stress tests with 10,000 concurrent duplicate requests per second confirmed the solution achieved full data consistency with negligible performance impact.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Engrava library uses deterministic memory consolidation to fix long-running AI agents

Developers have released Engrava, an open-source Python library designed to give AI agents structured, inspectable long-term memory stored in a single SQLite file. The library models memory as a typed knowledge graph where nodes represent thoughts and typed edges capture relationships, addressing shortcomings of purely vector-based approaches that can blur or contradict stored information. A deterministic consolidation cycle scores each stored thought across five signals — recency, staleness, confirmation, confidence, and frequency — and only promotes facts that meet configurable thresholds, such as requiring at least two confirmations before a piece of information is treated as settled. The entire consolidation process runs as arithmetic over SQLite rows with no language-model or network calls, making it reproducible and auditable via a YAML policy file. The design draws on cognitive-architecture research, including studies on selective memory stabilization during sleep, to keep the memory system a judgement layer rather than a passive accumulation store.

0 comments Read more at DEV Community