Turla and Gamaredon Working Together in Fresh Ukrainian Intrusions

Two Russian state-sponsored threat actors have been working together in recent cyberattacks against Ukrainian targets, according to ESET. The company found that between February and April 2025, tools that Gamaredon had deployed were used to restart and deploy Turla malware on selected Ukrainian systems. Turla, also known as Krypton, Snake, Venomous Bear and Waterbug, has been active since at least 2004, while Gamaredon, also known as Armageddon and several other names, has been active since at least 2013.

In February 2025, Gamaredon’s PteroGraphin tool was used as a recovery method to restart Turla’s Kazuar espionage implant, and in April Gamaredon’s PteroOdd and PteroPaste were used to deploy Kazuar v2 installers. ESET notes that the two groups are run by officers of the Russian intelligence service FSB, with Gamaredon associated with Center 18 and Turla with Center 16.