cyber.hendryadrian.com
Threat Research · sentinelone.com

Researchers Link Gamaredon Activity to Turla Access in Ukraine

· Original article ↗

Summary

ESET researchers describe evidence that Gamaredon tooling enabled Turla to deploy its Kazuar backdoor and restore access to high-value Ukrainian targets between February and June 2025.

Key points

  • Researchers observed Gamaredon activity enabling Turla operations on already-compromised Ukrainian systems between February and June 2025.
  • Gamaredon tools including PteroGraphin and PteroOdd were used to deploy Turla’s Kazuar backdoor.
  • In at least one case, Gamaredon activity reportedly helped restore Turla’s access after it appeared to have lost its foothold.
  • The presentation examines Kazuar versions 2 and 3 and their deployment chains and capabilities.
  • The research describes a possible division of labor in which Gamaredon helps establish or maintain access while Turla deploys an advanced espionage platform.
  • The activity targeted high-value Ukrainian organizations, including military and government entities.

Article Details

Attack Vectors
  • Gamaredon used spearphishing to compromise military and government organizations in Ukraine.
  • Gamaredon tooling, including PteroGraphin and PteroOdd, was used to deploy Turla's Kazuar backdoor on already compromised systems.
Defensive Notes
  • Defenders can connect initial access activity with downstream post-compromise objectives to understand how espionage implants are sustained inside contested networks.
  • Threat hunters and intelligence teams tracking activity in Ukraine can monitor for collaboration between Gamaredon and Turla.

MITRE ATT&CK

T1566 · PhishingThe article says Gamaredon relies on spearphishing to compromise military and government organizations.

People

Matthieu FaouESET researcher who presented the findings on Gamaredon and Turla.Zoltán RusnákESET researcher who presented the findings on Gamaredon and Turla.

Threat Actors

GamaredonEspionage actor described as targeting Ukraine; its tooling enabled Turla operations on already compromised systems.TURLA RELICEspionage actor whose Kazuar backdoor was deployed with Gamaredon tooling on already compromised systems.

Malware

Kazuarand June 2025, Gamaredon tooling, including PteroGraphin and PteroOdd, was used to deploy Turla’s Kazuar backdoor and, in at least one case, restore Turla’s access after the group appeared to have lost its

Tools

PteroGraphinAcross incidents observed between February and June 2025, Gamaredon tooling, including PteroGraphin and PteroOdd, was used to deploy Turla’s Kazuar backdoor and, in at least one case, restore Turla’s access after thePteroOddAcross incidents observed between February and June 2025, Gamaredon tooling, including PteroGraphin and PteroOdd, was used to deploy Turla’s Kazuar backdoor and, in at least one case, restore Turla’s access after the

Countries

RussiaUkraineIn this LABScon 25 presentation, ESET researchers Matthieu Faou and Zoltán Rusnák present the first technical evidence that Gamaredon actively facilitated Turla’s access to high-value Ukrainian targets in Ukraine.

Industries

Governmentspearphishing, lightweight custom tooling, and fast operational tempo to compromise military and government organizations. Matthieu and Zoltán show how those patterns continue to evolve while remaining highlyMilitaryrelies on relentless spearphishing, lightweight custom tooling, and fast operational tempo to compromise military and government organizations. Matthieu and Zoltán show how those patterns continue to evolve while

Related Articles