https://www.bleepingcomputer.com/news/security/russian-hackers-use-iranian-threat-groups-tools-servers-as-cover/

The Russian-backed Turla cyber-espionage group used stolen malware and hijacked infrastructure from the Iranian-sponsored OilRig to attack targets from dozens of countries according to a joint United Kingdom's National Cyber Security Centre (NCSC) and U.S. National Security Agency (NSA) advisory published today.

Turla is an advanced threat group tracked by security outfits as Waterbug, Snake, WhiteBear, VENOMOUS BEAR, and Kypton, an advanced persistent threat (APT) group with a focus on cyber-espionage and a wide range of victims, from military and government to education and research entities. [1, 2, 3]