Inside a Quiet Alliance of Gamaredon and Turla

Gamaredon and Turla, two Russia-aligned groups with distinct roles and toolsets, have been observed working the same Ukrainian endpoints. The interesting part is not coexistence, it is a live handoff where one actor’s tooling restarts or installs the other’s backdoor.

This piece unpacks how that handoff operates, why it changes triage and hunting, and what to do when the telemetry looks like two intrusions at once.

From coexistence to operational handoff

Many teams have learned to expect Turla to hijack other actors’ infrastructure. What is new here is direct operational use of Gamaredon’s implants to activate or deploy Turla’s Kazuar backdoor on carefully chosen hosts. Think of it as intra-agency access leasing: a noisy, wide-net actor lands broadly, then a surgical collector rides those footholds only on machines that matter.

On multiple Ukrainian systems, Gamaredon downloaders such as PteroGraphin and PteroOdd issued commands that launched or reinstalled Kazuar. In one representative case, a PteroGraphin task pulled a PowerShell payload that ultimately invoked an executable in a vendor-looking path under AppData, which then side-loaded Kazuar. The simplest reading is that Gamaredon provided an execution lane so Turla operators could recover or seed access without rebuilding their initial chain.

The non-obvious angle: this is not just tooling reuse, it is workflow reuse. The Gamaredon channel offered a low-friction, already-permitted path back into the host, which is attractive after endpoint controls appear. This lens helps explain why Turla’s victim set is small compared to Gamaredon’s sprawl, and why the most sensitive machines in a noisy outbreak warrant extra scrutiny.

Actionable tip: when you catch a Gamaredon downloader beaconing to publishing platforms, treat the host as a possible handoff surface, not only a Gamaredon case. Memory-check long-running processes for C# implants even if file telemetry looks purely PowerShell.

What the handoff looks like in telemetry

Control channel choreography

• Publisher-as-C2: Gamaredon downloaders fetch tasking from pages on public publisher services, sometimes editable with embedded tokens. If an operator, any operator, knows the token, they can change the payload without touching the endpoint. Example: a PteroGraphin script reads a page and decrypts its content with a hardcoded key, yielding a second-stage PowerShell that pulls more instructions.
• Staging hops: Collected host traits, such as computer name and volume serial, are posted to worker endpoints fronted by content delivery networks. That post often precedes a launch instruction for a local executable that side-loads a DLL carrying Kazuar.
• Confirmation pings: After side-loading, a short burst of process list or system info posts to a dynamic DNS host often confirms success. If you see Gamaredon-style staging immediately followed by a short-lived post of running processes, consider a Turla activation in progress.

Loader behavior and masquerade

• Side-loading under friendly names: Launchers live under plausible vendor directories, for example under a path resembling Local Programs for a well known hardware or media brand, with filenames like vncutil64.exe or LaunchGFExperience.exe loading a companion DLL. The mechanism matters: Windows prefers a local DLL with a matching export, handing execution to the implant with no network touch until later.
• Kazuar roles split duty: Recent Kazuar builds assign roles such as KERNEL, BRIDGE, and WORKER. Only one role talks out, others execute tasks. Practical effect: network-only detection can miss workers on the same host, so pair egress monitoring with memory scanning for managed code sections.

Actionable tip: alert on processes started by PowerShell that immediately spawn binaries from vendor-looking subfolders in user space and then load non-signed DLLs from the same directory.

Why this matters for triage and threat hunting

Gamaredon’s style is intentionally loud, with removable media LNKs and frequent task pulls. Turla’s style is intentionally quiet, with careful host selection and staged C# implants. When both operate on the same endpoint, the noise becomes a shield. Analysts tune out repetitive downloader activity, miss the side-load that follows, and under-triage the machines that actually matter. The asymmetry is simple: Gamaredon pays the detection cost, Turla reaps the intelligence benefit.

There is a trade-off in response. If a team evicts the noisy downloader first, the Kazuar operator may still have a planted loader and can relight using another lane. If a team focuses only on the elegant backdoor, the downloader may re-seed it hours later. Handoff-aware containment means closing both the command lane and the implant foothold in one move, or sequencing them so reactivation is not possible in the gap.

Anti-pattern to avoid: single-actor tunnel vision. Treating mixed toolmarks as a single intrusion often leads to wrong scoping. The mechanism of failure is that playbooks keyed to Gamaredon stop at script removal, leaving side-loaded DLLs and scheduled relaunchers intact. This approach fails if the host had already received a Turla payload through that channel.

Actionable tip: when you confirm Gamaredon tasking, promote at least one impacted host to deep-dive. Hunt for .NET reflective loads, injected threads in benign-named processes, and DLL search order abuse. Do this before broad cleanup.

Representative scenario: access leasing in action

Consider a mid-size public agency workstation fleet with standard endpoint controls and outbound filtering by category.

• Context: Office endpoints allow browser access to publishing platforms for business content, and developer tools are restricted. EDR is deployed broadly, with PowerShell logging enabled.
• Trigger, T+0: A user opens a shortcut file from shared storage. Within minutes, PowerShell retrieves content from a publisher API page, then fetches a second-stage script. EDR flags an obfuscated command but auto-remediates only the script file.
• Cascade, T+1h: The second-stage posts the host name and a disk serial to a worker endpoint. A process launches from a directory that mimics a vendor installer in the user profile and loads a local DLL. No outbound traffic is seen from that process, because only the BRIDGE role talks out and it is not present yet. Controls fail because allowlists trust the directory name and do not verify the signer of the loaded DLL.
• Response, T+4h: Analysts isolate the host and remove the downloader artifacts. They do not memory-scan the masquerading process. The next morning, a scheduled task tied to the same vendor-looking directory relaunches the loader, which then receives BRIDGE tasking when egress rules are relaxed for maintenance.
• Lesson, T+48h: The initial downloader was Gamaredon, the loader was in place for Turla. The failed control was path-name trust without DLL load auditing. The fix pairs script cleanup with memory inspection of any process spawned by PowerShell and blocks publisher API endpoints for PowerShell only, not for browsers.

Actionable tip: implement DLL load auditing on processes launched by scripting engines, and quarantine by parent-child chain, not just by file hash.

Detection and response moves that travel well

Signals that suggest a handoff

• PowerShell decoding a payload from a publisher API response parameter such as return_content, followed by machine identity posts to a worker-like subdomain.
• Immediate execution of binaries under vendor-looking folders in user space, then DLL loads from the same folder.
• Process-list or system-info posts to dynamic DNS hosts shortly after a side-load, with no prior DNS lookups from the loader binary.
• Enumeration of .NET versions by a script that otherwise matches Gamaredon tradecraft, a hint that the data is destined for a C# implant operator.

Containment without tipping off operators

• Stage egress controls to sever both lanes: block scripting engine access to publisher APIs and worker domains, and simultaneously suspend processes that recently loaded unsigned DLLs from user-writable paths. This works when the loader has not persisted under a Windows service name. It fails if persistence is inside a legitimate signed service, in which case service isolation first is safer.
• Sinkhole dynamic DNS hostnames observed in the confirmation pings and monitor reconnection attempts. This works when the operator expects a quick success signal. It fails if fallbacks are pre-configured and rotate through unrelated domains.
• Snapshot memory on any process spawned by scripts in the last day, then evict. This works when the implant is managed code with recognizable metadata. It fails if the payload has already migrated to a kernel driver, in which case memory capture requires a different collection path.

What not to do

Avoid blanket blocking of entire messaging or publishing platforms for all processes, because business browsers often rely on them. The failure mode is users pivoting to unmanaged channels, erasing the visibility you had. Prefer process-scoped egress rules: allow browsers, deny PowerShell and script hosts, and log exceptions with command line and parent process.

Actionable tip: create a detection that fires when a script host contacts a publisher API and, within five minutes, a process starts from a user-writable vendor-looking path.

What to expect next and how to test it

I expect the access-leasing pattern to persist because it reduces operator time on target. We should also expect parallel maintenance of multiple Kazuar branches, one tuned for stealthy side-loading and one for compatibility with older loaders. This prediction holds if you continue to see Gamaredon-style staging paired with both modern and legacy Kazuar features on new hosts. It fails if Turla consolidates to a single branch and stops accepting tasking through publisher-hosted lanes.

A second expectation is regional spillover, for example the same installer logic turning up on hosts outside the primary theater where Gamaredon has footholds. This holds when similar side-load chains appear with identical staging scripts and different confirmation domains. It fails if you only observe the pattern in the original geography while adjacent regions show unrelated delivery.

Make these testable: tag cases where a Gamaredon downloader enumerates .NET versions, then watch for a C# implant within a day. If the correlation repeats across environments, you have operational proof of handoff. If it does not repeat, revisit the assumption that the data was meant for Turla and look for a separate consumer.

Actionable tip: in hunts that start with Gamaredon artifacts, set a time-bound watch for side-loaded DLLs in vendor-looking paths and capture memory from any such process before remediation.