Google's Threat Intelligence Group has linked Russian state-sponsored hacking group Turla to a previously undocumented .NET backdoor named STOCKSTAY, deployed against government and military organizations in Ukraine. SecurityWeek independently confirmed the backdoor's use in espionage operations, though technical details remain sparse from both sources.
The backdoor, described by Google as continually developed by Turla, has also been used against entities with an interest in Italian foreign policy. Neither source provided a CVSS score, CVE identifier, or specific number of affected systems, leaving the full scope of the campaign unclear. Active exploitation status was not specified in available reports.
STOCKSTAY operates as a Windows backdoor, but no attack vector details, exploit mechanisms, or indicators of compromise were disclosed by Google or SecurityWeek. The publicly available information is limited to attribution and broad targeting descriptions, with no technical breakdown of how the malware gains initial access or maintains persistence on compromised systems.
No mitigation steps, patches, or workarounds have been released for STOCKSTAY. The lack of technical data suggests organizations should follow standard defensive practices against known Turla tactics, including network segmentation and monitoring for unusual .NET process execution on Windows systems.
Turla is a well-resourced Russian APT group with a history of long-term espionage operations. The targeting of Ukrainian government and military aligns with Russia's broader cyber activities amid the ongoing conflict, but the inclusion of Italian foreign policy interests signals a potential expansion of the group's reconnaissance priorities.