The Qakbot malware operators have shifted tactics again to adapt to changes in defenses.
A new RAT known as SeroXen is for sale on forums and social media platforms and has the ability to evade EDR and delivers a rootkit.
The discovery of CosmicEnergy is unique because malware families targeting industrial control systems are rarely disclosed.
Researchers said that it "is difficult to measure" the potential long-term impact of TurkoRat infections on developer systems.
While Operation Medusa disrupts long standing espionage efforts by Turla, security researchers say that its effects will only be temporary.