Russian spy groups Turla, Gamaredon join forces to hack Ukraine, researchers say

Researchers (ESET) documented the first observed technical collaboration in Ukraine between Russian-linked APTs Gamaredon and Turla: Gamaredon provided initial access using a range of custom tools (PteroLNK, PteroStew, PteroOdd, PteroEffigy, PteroGraphin) while Turla deployed its Kazuar v3 backdoor and at times used Gamaredon implants/infrastructure to manage its malware; Gamaredon is widespread in Ukraine while Turla appears selective for high-value targets, with likely entry via spearphishing and infected removable drives.