Emerging​ Red Team tool Tuoni ⁢C2 Used in Attempted Breach ‌of US Real Estate Firm

October 26, 2025 – A⁤ US-based real estate firm was targeted ​in mid-October by a cyberattack leveraging the recently released Tuoni‌ command-and-control (C2)⁤ framework, researchers at Morphisec revealed today. ​The incident highlights a growing trend of malicious ​actors adopting tools originally designed for legitimate penetration testing and red team exercises.

Tuoni, advertised as an ⁢advanced C2 framework for security professionals, became freely available as a “Community ‌Edition” download from GitHub ​in early ‍2024. ⁣The attackers in ‌this case ⁣utilized Tuoni’s ability to deliver stealthy,‍ in-memory payloads. ⁣According to Shmuel Uzan, a Morphisec researcher, ​”The campaign leveraged the emerging Tuoni C2 framework…that delivers stealthy, in-memory payloads.”

The ​attack unfolded through a likely social engineering scheme involving Microsoft Teams impersonation, where attackers allegedly posed as trusted vendors or colleagues to trick an employee into executing a PowerShell command. This command downloaded ⁣a second powershell script from⁣ “kupaoquan[.]com,” which concealed a further payload within a bitmap image using steganographic techniques. The resulting execution of “TuoniAgent.dll” established a connection to the C2 server, granting the attackers potential remote control of the compromised machine.

Morphisec noted potential signs ⁤of AI assistance in the initial loader’s code generation, citing scripted comments and a modular structure. This incident⁢ follows a ⁣September 2025 report from Check Point detailing the weaponization of AI-powered tool HexStrike AI for accelerated vulnerability exploitation, further illustrating the evolving landscape of⁤ cyber threats. While the attack on the real estate ‌firm was ultimately unsuccessful, it ⁤underscores the increasing misuse of legitimate security tools for malicious purposes.

Russian Hackers Gamaredon and Turla Linked in Coordinated Ukraine‍ Attacks

Kyiv, Ukraine – Cybersecurity researchers have uncovered evidence of collaboration between russian state-sponsored hacking groups Gamaredon and Turla, revealing a coordinated effort to⁤ deploy the Kazuar backdoor against targets in Ukraine. The findings, published ​by ESET, detail a⁣ series of attacks throughout⁤ early 2025 where Gamaredon gained initial access to systems, subsequently handing off control to Turla for malware deployment.

The attacks ⁣leverage a complex chain of custom malware, beginning with Gamaredon’s PteroGraphin tool, which⁢ downloads​ a PowerShell downloader,​ PteroOdd. PteroOdd then retrieves a ‌payload ⁤from Telegraph to execute ‍Kazuar. Victims’ computer names⁢ and​ system drive volume serial numbers are exfiltrated to ‌a Cloudflare Workers subdomain prior to Kazuar’s launch. ESET noted Kazuar v2 and v3 share the same codebase, with v3 comprising approximately 35% more C# lines and introducing new network transport methods via web sockets and Exchange ​Web Services.

Evidence ‍of the collaboration first⁤ surfaced in February 2025, when Kazuar was detected ⁤on a system accessed by Gamaredon. A subsequent PteroOdd sample found on a‌ separate Ukrainian machine in March 2025 also ⁤contained Kazuar. The malware ⁤harvests extensive system information, including installed .NET versions, and transmits it to the domain “eset.ydns[.]eu.” Researchers believe this data gathering is intended for Turla, given‌ Gamaredon’s lack of .NET malware and Kazuar’s‌ .NET foundation.

A second attack wave in mid-April⁤ 2025 utilized another PowerShell downloader, PteroEffigy, ​to deliver Kazuar v2 (“scrss.ps1”)‍ via the “eset.ydns[.]eu” domain.A third attack, observed⁣ on June 5 and 6, 2025, involved PteroPaste dropping Kazuar v2 (“ekrn.ps1”) from​ the domain “91.231.182[.]187.” The use of “ekrn” is suspected to be a intentional attempt to mimic “ekrn.exe,” a legitimate ESET⁣ endpoint security binary.

“We now believe with high confidence that both groups⁤ – separately associated with the FSB – are cooperating and that Gamaredon is providing initial access to Turla,” stated ESET researchers‌ Matthieu Faou‌ and Zoltán​ Rusnák. This collaboration​ highlights a growing trend of coordinated cyber operations between Russian state-sponsored actors, increasing the sophistication and effectiveness of attacks ⁤against Ukraine and potentially ‌other targets. ​

kazuar,initially‌ documented by Palo Alto Networks in late 2023,is a versatile backdoor capable of extensive system compromise and data exfiltration. The observed attacks demonstrate a refined and collaborative approach to targeting Ukrainian infrastructure and organizations.