ESET researchers Matthieu Faou and Zoltán Rusnák present technical evidence of operational collaboration between two Russian FSB-linked espionage groups — Gamaredon and Turla — targeting Ukraine in 2025. Between February and June 2025, Gamaredon's tooling (PteroGraphin, PteroOdd) was used to deploy Turla's Kazuar backdoor on high-value Ukrainian targets, with Gamaredon in some cases restoring Turla's lost access. The research reveals a rare division of labor in Russian cyberespionage: one group establishes initial access while the other deploys advanced implants. The talk also covers Kazuar v2 and v3 analysis, helping defenders understand how sophisticated backdoors are sustained inside contested networks.
64 Impressions