Russian cyber spies hide behind other hackers to target Ukraine

Turla (aka Secret Blizzard), a Russian FSB-linked APT, ran a March–April 2024 espionage campaign against Ukrainian military devices using other actors' infrastructure (Amadey botnet and Storm-1837) to deliver PowerShell droppers and deploy modular backdoors Tavdig and KazuarV2; Microsoft observed reconnaissance focused on Starlink-connected devices, use of the Cookbox backdoor and exploitation of CVE‑2023‑38831, and provided mitigations and hunting queries.