Cybersecurity researchers have discerned evidence of two Russian hacking groups Gamaredon and Turla collaborating together to target and co-comprise Ukrainian entities. In a separate instance in April and June 2025, ESET said it also detected the deployment of Kazuar v2 through two other Gamaredon malware families tracked as PteroOdd and PteroPaste. The deployment of the latest version of Kazuar (Kazuar v3) is said to have taken place towards the end of February. "Kazuar v3 comprises around 35% more C# lines than Kazuar v2 and introduces additional network transport methods: over web sockets and Exchange Web Services." ]eu" domain to deliver Kazuar v2 ("scrss.ps1"), which was documented by Palo Alto Networks in late 2023.