Google Details Turla's New STOCKSTAY Backdoor Used in Ukraine Espionage Attacks
Summary: Google Threat Intelligence Group attributed a previously undocumented .NET backdoor called STOCKSTAY to the Russian state-sponsored actor Turla, which has deployed it against government and military organizations in Ukraine and entities interested in Italian foreign policy. The multi-component implant communicates with its command-and-control server over a secure WebSocket connection, shares significant code and functional overlap with Turla's Kazuar implant used since 2017, and was delivered as recently as November 2025 via RAR archives exploiting the WinRAR vulnerability CVE-2025-8088.
Key Takeaway: Turla has used STOCKSTAY both for initial access into unprofiled environments and for post-exploitation on a specific host, which GTIG says implies the actor already knows exactly which machine it is targeting through existing access to the environment. The same WinRAR flaw, CVE-2025-8088, has now been exploited by Sandworm, Gamaredon, and RomCom as well as Turla.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2025-8088
- Related