Russian Hacking Groups Gamaredon and Turla Target Organizations to Deliver Kazuar Backdoor

Two prominent Russian state‑sponsored hacking groups, Gamaredon and Turla, have been observed collaborating in sophisticated cyberattacks against Ukrainian organisations to deploy the Kazuar backdoor. Security researchers say the effort shows unprecedented coordination between FSB‑affiliated actors, with Gamaredon operating from occupied Crimea under FSB Center 18 direction and Turla attributed to Center 16.

Between February and June 2025, there were multiple instances where Gamaredon’s initial access tools were used to deploy Turla’s Kazuar backdoor on high‑value targets in Ukraine, and Kazuar version 3 is reported to contain about 35% more code than its predecessor. The operation involves three attack chains, including Gamaredon restarting Turla’s Kazuar v3 implant and direct deployment of Kazuar v2 via Gamaredon tools, with coordinated use of Telegra[.]ph and compromised WordPress servers as payload and C2 channels.

Over 18 months, researchers detected Turla presence on only seven machines in Ukraine, with Gamaredon providing initial compromise in January 2025 and Kazuar v3 deployment in February 2025, signalling a shift toward more selective targeting of highly sensitive intelligence.