Google Details Turla's New STOCKSTAY Backdoor Used in Ukraine Espionage Attacks
Turla deploys new STOCKSTAY backdoor against Ukraine and entities interested in Italian foreign policy.
The Russian state-sponsored threat actor Turla has been linked to a new .NET backdoor named STOCKSTAY, targeting Ukrainian government and military organizations, as well as entities interested in Italian foreign policy. This backdoor, which shares code with Turla's older Kazuar implant, is designed to mimic legitimate stock market tools or other harmless applications like PDF viewers. STOCKSTAY operates with multiple components, including a downloader, a proxy-aware tunneler, the main backdoor for information gathering, and an orchestrator for configuration and command execution.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Russian state-sponsored group Turla deployed a sophisticated .NET backdoor (STOCKSTAY) that masquerades as legitimate applications such as stock market tools and PDF viewers, making it extremely difficult for end users and automated tools to detect. The malware's multi-component architecture — including a downloader, tunneler, main backdoor, and orchestrator — demonstrates a deliberate effort to evade detection while enabling persistent espionage. This attack underscores the danger of trusting the appearance of legitimate-looking software, especially in high-value government and military environments. The overlap with Turla's older Kazuar implant also highlights that threat actors reuse and evolve proven codebases, meaning defenders must continuously update detection signatures and threat intelligence.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security monitoring (SIEM)
Logs from everywhere end up in one place, with alerts that someone actually sees.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — STOCKSTAY
- malware — Kazuar