Gazer - description

Sources:

ESET detailed technical analysis of Gazer backdoor malware

Turla hacking group using Gazer backdoor to target governments

Gazer is a malware campaign that targets consulates, ministries, and embassies worldwide to spy on governments and diplomats. It receives encrypted commands from a remote command and control server and evades detection by using compromised, legitimate websites (that primarily use the WordPress Content Management System) as a proxy. Gazer uses a code-injection technique to take control of a machine and remain hidden for extended periods while stealing information.

Flowmon ADS detects communication with command and control servers.