Russian Hackers Gamaredon and Turla Collaborate to Deploy Kazuar Backdoor in Ukraine

Cybersecurity researchers have found that two Russian groups, Gamaredon and Turla, are collaborating to target Ukrainian entities and deploy Kazuar backdoors, according to ESET. The Slovak firm observed Gamaredon tools PteroGraphin and PteroOdd used to run Kazuar backdoor on an endpoint in Ukraine in February 2025, with Turla likely actively cooperating to access specific machines and deliver Kazuar.

ESET notes PteroGraphin was used to restart Kazuar v3, suggesting it served as a recovery method, and that Kazuar v2 was deployed in separate April and June 2025 operations via PteroOdd and PteroPaste. The two groups, both affiliated with the FSB, are described as cooperating, with Gamaredon providing initial access to Turla.

Seven Ukrainian machines showed Turla-related indicators over 18 months, four of which were breached by Gamaredon in January 2025, and Kazuar v3 deployments were reported towards the end of February. ESET emphasised that Kazuar v2 and v3 share the same codebase, while the attackers’ toolset, including PteroGraphin, PteroOdd and PteroPaste, is used to drop and execute Kazuar and exfiltrate system information.

According to ESET researchers Matthieu Faou and Zoltán Rusnák, the collaboration appears to be a notable convergence driven by the groups’ activities in Ukraine.