STOCKSTAY , a new and sophisticated backdoor written in .NET , is reportedly linked to the Russian state-sponsored Turla group — also known as Secret Blizzard 16. According to The Hacker News, the Google Threat Intelligence Group (GTIG) revealed that the malicious tool is actively being used against government and military organizations in Ukraine , as well as against entities with an interest in Italian foreign policy .
STOCKSTAY 's development has been traced back to at least December 2022 , and it shares significant code similarities with KAZUAR , one of Turla 's core tools since 2017 .
Turla hackers and STOCKSTAY backdoor
Turla has a long history of targeting Western foreign ministries and defense organizations, particularly during times of tension. In the context of the ongoing conflict in Ukraine, the group has intensified its cyberespionage operations, leveraging compromised government infrastructure within the country to deploy STOCKSTAY and accompanying payloads. In a recorded incident response by Mandiant, STOCKSTAY was deployed alongside other proprietary Turla tools, such as WILDDAY, DIAMONDBACK , and KAZUAR.
See also: Russian Gamaredon and Turla install Kazuar Backdoor in Ukraine
Attacks that distribute STOCKSTAY systematically exploit academic or diplomatic bait. Notable examples include MSI files named “DiplomacyEduAI” and fake “UAV Report” reports targeting Ukrainian military personnel in November 2025. The initial attack vector includes spear-phishing emails with malicious RDP files and RAR archives, exploiting CVE-2025-8088 — a critical path traversal in WinRAR.
STOCKSTAY: Architecture and technical details
STΟCKSTAY is a multi-component backdoor that uses the Windows Forms framework and communicates with the C2 server via a secure WebSocket connection , leveraging the open source websocket-sharp library . Its individual components communicate with each other via IPC (inter-process communication) based on WM_COPYDATA messages .
Initially, the tool was designed to mimic a stock data viewer application, but was later adapted to appear as harmless software, such as PDF viewers or calculators.
It starts with a downloader component codenamed STΟCKSTAY.MARKETMAKER, which installs and executes three additional modules: STOCKSTAY.STOCKBROKER, a tunneler that creates a secure WebSocket to a remote server; STOCKSTAY.STOCKTRADER, the main backdoor that collects information and executes commands; and STOCKSTAY.STOCKMARKET, the orchestrator that manages the malware's configuration. The orchestrator defines parameters such as the WebSocket, the execution time, and the days during which the malware should not run.
See also: FlutterShell Backdoor Spreads on macOS via Malicious Google and YouTube Ads
STOCKSTAY.STOCKTRADER supports a number of commands, including: deleting files ( Del ), counting directories ( Dir ) , downloading files ( Get ), taking a screenshot ( Image ), running a new process ( Run ), gathering system information ( Sysinfo ), reading/writing/deleting Windows Registry values, and decompressing ZIP files .
GTIG also located a publicly accessible GitHub repository containing a Python implementation of the victim-facing STΟCKSTAY WebSocket server controller, which is responsible for handling incoming messages from a connected client and recording its IP address.
Protection recommendations from STOCKSTAY and Turla
Organizations that may be targeted by Turla should take immediate action. First of all, it is critical to immediately patch the CVE-2025-8088 vulnerability by updating WinRAR . In addition, it is recommended to monitor the network for WebSocket connections to *.onrender.com and detect the websocket-sharp.dll library on the systems.
Users should be trained to recognize “DiplomacyEduAI” or “UAV Report” type baits used in spear-phishing, while increased suspicion towards unsolicited RDP files and RAR archives is essential. Finally, the development of YARA rules and the utilization of IOCs published by GTIG via the Google Cloud blog are important defense tools.
See also: Turla: Targets Exchange servers with new malware backdoor DeliveryCheck
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
STOCKSTAY represents a new, sophisticated addition to Turla’s arsenal, demonstrating that the team continues to invest in developing sophisticated espionage tools. Its modular architecture, ability to mimic legitimate software, and use of legitimate platforms for C2 infrastructure make it particularly dangerous for government and military organizations. Early notification, user education, and active network monitoring remain the most effective lines of defense against such threats.
