Two of the Kremlin’s most active hack groups are collaborating, ESET says

Two of the Kremlin’s most active hacking units have been observed working together on malware attacks that target high-value Ukrainian devices, according to ESET. The two groups are Turla and Gamaredon, both widely considered to be units of Russia’s FSB. ESET said it has detected both groups’ malware installed alongside each other or interoperating on multiple devices in recent months, with four Gamaredon–Turla co-compromises identified in Ukraine in February.

The researchers described a plausible scenario in which Gamaredon provided access to Turla operators to issue commands and restart Kazuar, and to deploy Kazuar v2 on other machines. In April and June, ESET detected Kazuar v2 installers being deployed by Gamaredon malware, though the compromises occurred after the payloads had already been installed.

All told, ESET regards active collaboration between the groups as the most likely explanation for the observed activity, noting that Gamaredon has previously collaborated with other groups. According to ESET, Turla’s interests appear to focus on highly sensitive machines rather than broad recruitment of targets.