LABScon25 Replay: Gamaredon x Turla: Unveiling a 2025 Espionage Alliance Targeting Ukraine
SentinelOne, Tuesday, June 2nd, 2026
ESET researchers reveal technical evidence of Gamaredon facilitating Turla's cyberespionage operations against Ukrainian targets in 2025.
At LABScon 25, ESET researchers Matthieu Faou and Zoltan Rusnak present the first technical evidence of direct operational collaboration between Gamaredon and Turla, showing how Gamaredon's tooling was used to deploy Turla's Kazuar backdoor against Ukrainian military and government organizations between February and June 2025.
The presentation details how Gamaredon, one of the most active espionage actors targeting Ukraine, uses relentless spearphishing and lightweight custom tools to establish access, which Turla then exploits with more advanced espionage platforms. The researchers analyze Kazuar v2 and v3 backdoors and examine how Russian cyberespionage operations divide labor, with one actor maintaining access while another deploys sophisticated implants.
The talk is essential for defenders and threat hunters tracking Russian state-aligned activity and understanding the continuing evolution of access brokering and inter-group collaboration tactics.