[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZ2laVVziVC2smRYyY3ZC8nqG7u_vnCF_A8trHva_C5Y":3},{"article":4,"iocs":44,"watch_terms":51,"solutions":52,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"09734d7b-fea1-43f9-95b8-d974de9c81b2","Google Details Turla's New STOCKSTAY Backdoor Used in Ukraine Espionage Attacks","google-details-turla-s-new-stockstay-backdoor-used-in-ukraine-espionage-attacks-00c478","The Russian state-sponsored threat actor known as Turla has been attributed to a previously undocumented .NET backdoor called STOCKSTAY that has been deployed against government and military organizations in Ukraine, and entities that have an interest in Italian foreign policy. Describing the Windows backdoor as continually developed by the hacking group, Google Threat Intelligence Group (","The Russian state-sponsored threat actor Turla has been linked to a new .NET backdoor named STOCKSTAY, targeting Ukrainian government and military organizations, as well as entities interested in Italian foreign policy. This backdoor, which shares code with Turla's older Kazuar implant, is designed to mimic legitimate stock market tools or other harmless applications like PDF viewers. STOCKSTAY operates with multiple components, including a downloader, a proxy-aware tunneler, the main backdoor for information gathering, and an orchestrator for configuration and command execution.","Turla deploys new STOCKSTAY backdoor against Ukraine and entities interested in Italian foreign policy.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002Fgoogle-details-turlas-new-stockstay.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEi9SthtlfUvEkaX0iZanYdYTAOV5hgm44yCwHu_3GCaoa11rO-GkO9oc0_qN9JGw2n86dsEsN_sdaYt2ra_4I_dQ57ja0kiUeYtkg1eY8ZJtu45oKtN-TqWLdKudnJPFQQFGPReCfu1xcfHGgfqgtLe8zyFlEoMnO2AwnsEsosf9LCZS9gJHq58Q8OcPlWP\u002Fs1600\u002FSTOCKSTAY.jpg","2026-06-26T07:15:46+00:00","2026-06-26T10:00:08.18507+00:00",8,[17,20,23],{"name":18,"type":19},"Turla","threat_actor",{"name":21,"type":22},"Google","vendor",{"name":24,"type":25},".NET","technology","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":26,"icon":28,"name":29,"slug":30},null,"Nation-state","nation-state",[32,34,39],{"category":33},{"id":26,"icon":28,"name":29,"slug":30},{"category":35},{"id":36,"icon":28,"name":37,"slug":38},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45,48],{"type":38,"value":46,"context":47},"STOCKSTAY","Name of the .NET backdoor developed by Turla.",{"type":38,"value":49,"context":50},"Kazuar","Older implant by Turla, shares code with STOCKSTAY.",[21],{"controls":53,"vendors":133},[54,83,104],{"slug":55,"name":56,"problem":57,"products":58},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"slug":84,"name":85,"problem":86,"products":87},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[88,89,97],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xsiam","Cortex XSIAM","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xsiam","AI-driven security operations platform that centralises security data, detection, automation and response for the SOC.",{"vendor_slug":98,"vendor_name":21,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"google","\u002Fvendor-logos\u002Fgoogle.png","google-security-operations","Google Security Operations","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fsecurity-operations","Cloud SIEM and SOAR, formerly Chronicle.",{"slug":105,"name":106,"problem":107,"products":108},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[109,117,125],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",[134],{"slug":98,"name":21,"logo_path":99,"roles":135},[136],"reported_by",{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":153},"turlas-stockstay-backdoor-targets-ukrainian-and-italian-linked-organizations","Turla's STOCKSTAY Backdoor Targets Ukrainian and Italian-Linked Organizations","The Russian state-sponsored group Turla deployed a sophisticated .NET backdoor (STOCKSTAY) that masquerades as legitimate applications such as stock market tools and PDF viewers, making it extremely difficult for end users and automated tools to detect. The malware's multi-component architecture — including a downloader, tunneler, main backdoor, and orchestrator — demonstrates a deliberate effort to evade detection while enabling persistent espionage. This attack underscores the danger of trusting the appearance of legitimate-looking software, especially in high-value government and military environments. The overlap with Turla's older Kazuar implant also highlights that threat actors reuse and evolve proven codebases, meaning defenders must continuously update detection signatures and threat intelligence.",[142,143,144,145,146,147,148,149,150,151,152],"NIST SP 800-53 SI-3 (Malicious Code Protection)","NIST SP 800-53 AC-3 (Access Enforcement)","NIST SP 800-53 AU-6 (Audit Record Review)","CIS Control 2 (Inventory and Control of Software Assets)","CIS Control 8 (Audit Log Management)","CIS Control 13 (Network Monitoring and Defense)","MITRE ATT&CK T1036 (Masquerading)","MITRE ATT&CK T1071 (Application Layer Protocol)","MITRE ATT&CK T1090 (Proxy)","NIST CSF DE.CM-1 (Network Monitoring)","GDPR Article 32 (Security of Processing)",{}]