ESET uncovers Gamaredon–Turla collaboration in Ukraine cyberattacks

ESET uncovers evidence that Russia-linked groups Gamaredon and Turla collaborated in cyberattacks on Ukraine between February and April 2025. The findings describe four co‑compromises in which Gamaredon deployed tools such as PteroLNK, PteroStew, PteroOdd, PteroEffigy and PteroGraphin, while Turla installed Kazuar malware, including v3 on some targets.

According to ESET researchers, Turla even used Gamaredon’s implant to restart Kazuar, with Gamaredon subsequently deploying Kazuar v2 directly, marking the first technical link between the two groups. Over the period studied, Turla operated on seven Ukrainian machines, as Gamaredon breached four initially in January 2025, and Turla’s activity followed in the subsequent month.

The analysis highlights that the two APTs, both tied to Russia’s FSB, often work together in Ukraine, though they continue to compete in other spheres. ESET released IoCs and samples for the attacks it investigated.