Symantec says Russian-backed advanced threat actor Turla hijacked infrastructure of OilRig hackers to compromise a target both actors were interested in. Turla is also known by the names Waterbug, Snake, WhiteBear, VENOMOUS BEAR, and Kypton. Researchers say that while a collaboration between the two groups is possible, they did not find evidence supporting this theory. The researchers noticed signs of Waterbug activity on January 11, 2018, when the group dropped one of its tools on the victim’s network.
Source: https://www.bleepingcomputer.com/news/security/turla-espionage-group-hacks-oilrig-apt-infrastructure/