In this blogpost, we uncover the first known cases of collaboration between Gamaredon and Turla, in Ukraine. In April and June 2025, we detected that Kazuar v2 was deployed using Gamaredon tools PteroOdd and PteroPaste. We believe that Gamaredon compromised the first four machines in January 2025, while Turla deployed Kazuar v3 in February 2025. TurlaSimilarly, for Turla, we detected the use of Kazuar v2 and Kazuar v3, which we believe are exclusive to that group. Third chain: Deployment of Kazuar v2 via PteroPasteOn June 5th and 6th, 2025, we detected Gamaredon deploying a Turla implant on two machines in Ukraine.