Quick Takeaways
-
Collaborative Threat: Russian hacking groups Gamaredon and Turla are actively collaborating to target Ukrainian entities, leveraging shared malware tools for attacks.
-
Malware Deployment: The recent use of tools like PteroGraphin and PteroOdd by Gamaredon has allowed Turla to deploy its Kazuar backdoor on several Ukrainian systems since early 2025.
-
Historical Context: Gamaredon, active since 2013, and Turla, known since the late 1990s, have intensified their focus on Ukraine following Russia’s invasion, primarily targeting the defense sector.
- Data Gathering Tactics: The malware employed is designed to exfiltrate significant system data, indicating a sophisticated approach in accessing and compromising Ukrainian systems.
Collaboration Between Gamaredon and Turla
Cybersecurity researchers have identified a troubling partnership between two Russian hacker groups, Gamaredon and Turla. This collaboration targets Ukrainian entities, intensifying the ongoing cyber conflict. Recently, Slovak company ESET found evidence of Gamaredon using its tools, PteroGraphin and PteroOdd, to deploy Turla’s Kazuar backdoor. This deployment occurred in February 2025, suggesting a strategic alliance aimed at penetrating Ukrainian defenses.
ESET’s report highlighted that PteroGraphin functioned as a recovery tool for Kazuar, potentially reigniting the backdoor after issues. Additionally, multiple instances in April and June confirmed further deployments of Kazuar, showcasing the growing threat to cybersecurity in Ukraine. Both hacking groups have historical ties to the Russian Federal Security Service (FSB), known for orchestrating cyberattacks against the Ukrainian government.
The Evolving Malware Landscape
Kazuar remains a significant concern. It serves as a versatile malware platform, capable of adapting to new tactics over time. The recent iterations, Kazuar v2 and v3, share a common codebase but differ in capabilities, with v3 offering enhanced network methods. This evolution reflects the hackers’ need to stay ahead of defenses, especially with the backdrop of Russia’s 2022 invasion of Ukraine.
The attack patterns reveal a complex chain: Gamaredon deploys PteroGraphin, which activates further downloaders like PteroOdd, ultimately executing the Kazuar backdoor. These operations demonstrate a high level of sophistication. In total, researchers detected Turla-related indicators on seven Ukrainian machines within 18 months, pointing to a systematic effort to compromise key assets. As this digital war continues, the collaboration may pave the way for more coordinated assaults, threatening not just Ukraine but also broader cybersecurity landscapes.
Expand Your Tech Knowledge
Learn how the Internet of Things (IoT) is transforming everyday life.
Discover archived knowledge and digital history on the Internet Archive.
CyberAttacks-V1
