As cited
Citation snapshot as of .
threat intel
LABScon25 Replay | Gamaredon x Turla: Unveiling a 2025 Espionage Alliance Targeting Ukraine
ESET researchers presented technical evidence at LABScon 25 demonstrating that Gamaredon actively facilitated Turla's access to high-value Ukrainian targets between February and June 2025. Gamaredon's tools, including PteroGraphin and PteroOdd, were used to deploy Turla's Kazuar backdoor and restore access after compromise. The presentation reveals how Russian cyberespionage groups divide operational labor, with Gamaredon establishing initial access through spearphishing while Turla deploys advanced espionage platforms for post-compromise objectives.
Why it matters: Ukrainian military and government defenders, as well as threat hunters tracking Russian state-aligned activity, need to understand this operational collaboration pattern to better detect and respond to access brokering chains where lightweight initial access tools precede deployment of sophisticated backdoors.
- Source published
- First seen by Cybersecurity Tracker