Skip to main content
IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Exposure
53 IOCs

STOCKSTAY Another Day: The Latest Addition to Turla’s Intelligence Gathering Apparatus

Google Threat Intelligence (GTIG / Mandiant)
Google Threat Intelligence (GTIG / Mandiant)
Published June 25, 2026Original Report

Threat Actors

Malware Families

Excerpt

Written by: Jordan Jones Introduction Google Threat Intelligence Group (GTIG) has conducted an in-depth analysis of a .NET backdoor, tracked as STOCKSTAY, that has been continually developed and deployed by the Russia-linked threat actor Turla (aka SUMMIT, Secret Blizzard, VENOMOUS BEAR, UAC-0194) since at least December 2022. Turla has deployed STOCKSTAY against government and military organizations in Ukraine, as well as entities with an interest in Italian foreign policy.…

Read the original report →

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYPlayTurlaINFRASTRUCTUREunknownCAPABILITYMETA StealerPlayVICTIMunknown
Adversary(2)
Infrastructure
Capability(2)
Victim

Indicators of Compromise

Open the mindmap →

53 indicators

TypeIndicatorConfidenceScoreFirst Seen
SHA256f04f43b6f7c2d86109c495179b497f7fb45fd95816623de1b77900f71b4f99edMediumScore 53/100First seen
SHA256d1e54270433a94aa3d45d888e4c62299bee3480eb2cb4a5489c7dda69d476c3eMediumScore 53/100First seen
SHA25619e6ed42248f9d03beb343a7c09a864dcd3cd671c29e1e5eac93579225224ac9MediumScore 53/100First seen
SHA2560d6b083208097d5b3e189891338540f6c64faaaaf268b0bb0b085dd53d5857b4MediumScore 53/100First seen
SHA256626330d22f77d9cbca9d40cc06568041703f194610c4c5a84bbb05a2e4ee7459MediumScore 53/100First seen
SHA256dfd5cb91d06b9649d4cab500343af80ad1144a9e46641cc406f43dd169003c22MediumScore 53/100First seen
SHA25698ce3c6e4dd05887ea619f2bbfeb2e2c2805ed07e85e119b79b828b7ef8be397MediumScore 53/100First seen
SHA25682707cfdf24dcb762f4615f01e1ba4d3dfdec4abe9cd588558d2634d7e6a5eebMediumScore 53/100First seen
SHA2567615140f78d9a0ce31cc9fe8c54c60028a7439cb32526fd97b10afef7145dd78MediumScore 53/100First seen
SHA256813c78b5b6ef28a9c0ed35f2c6cd88fc50880ab91f8777dfe7aaccb1c24b08d5MediumScore 53/100First seen
SHA256e3364ee21cae6725451e8bc9ab9933df0000fd19814170bd132da68d1906d5ffMediumScore 53/100First seen
SHA256f964353b9ae4bedbe62de6c0d7eafa9fb8b87897bbaea483aedaa8ae191834daMediumScore 53/100First seen
CVECVE-2025-8088HighScore 72/100First seen
SHA2561682e8d82016b3f10434d2ebac995fd3b6aa812f079bfd7888652e94a994d851MediumScore 53/100First seen
SHA256d3fd32f915c239872c9e7ed9408b1f36dfcef03aa68f9a396d05c437667cdb43MediumScore 53/100First seen
SHA256391e51354118fb87dc57650cbbd94258c3f7c0a0d6868040b7a473ad626ff25eMediumScore 53/100First seen
SHA2564e3bed10a8eff3e9205c1f37f647512464271d5ac65df7ae4709735621a38320MediumScore 53/100First seen
SHA25634fcbe7e90fc87a4f3766469c19a64f24672d7adb99e0198f5ba10d58911368bMediumScore 53/100First seen
SHA2569fe944147c15a87963b06baf6473288d64c23655a0ba9369c35566272d8efc73MediumScore 53/100First seen
SHA256ed88a43801b5c58b9be27fa74abaa278a48904f3cc1bc905f2d85e32448b96c5MediumScore 53/100First seen
SHA2566cee9e838792ac5e2098362d68ce93a9a2c095d476dc16b289fe8509c99b2b8bMediumScore 53/100First seen
SHA25681aabf646619ea5f4a72457cd3aa17c5988003d67e6454f45e7cb33613021bacMediumScore 53/100First seen
SHA256da8a96bc74e265f945f1cc6992c6dc0f9ea36ed1991f7b8d312db79d9bf78c40MediumScore 53/100First seen
SHA256e83f274bf9914c6cfc0c6b3cdadf089565f49dace4aca93287c22aba9641c8f3MediumScore 53/100First seen
SHA2560a545dd1b703cddfb3d582c8c70f65f556bbd580bfa836a387121eb837bda61bMediumScore 53/100First seen
SHA256249a4c7cacdd8e99a2a089a5c0ce904f2eff22e0e40fcfb10f7824dca6c51ecbMediumScore 53/100First seen
SHA25645bb8d1ab2c13bf4354294e13d3c9be15de625d807301905b98462f43f93e893MediumScore 53/100First seen
SHA256447f430b46fad5a3f8e8c5aad1f8f7f79af069489c3d9c29224bb9f14f0c7bf4MediumScore 53/100First seen
SHA256c905cb512018cc55512c6a22677c3d6f389c47afd54d7c85797868fc4fcb90e9MediumScore 53/100First seen
SHA25640b1208dda0cd5dd95c6b57764b2cfe7145b3ed9457f498408b4aaa05bf3ef50MediumScore 53/100First seen
SHA256b728eba4f0d6d16602fbad05a591f14391594262d3584b2e249e97f86e4dcc5aMediumScore 53/100First seen
SHA2563627f582420ad2782d452fe6d13fae42658d1484296351d3916703e25dcadd14MediumScore 53/100First seen
SHA2562623c6e3c1f5a7b5e735a64813bc0e1382ae45831f5fadffb08c0e7b096627f7MediumScore 53/100First seen
SHA256b064a3efb04ed77e6c57955089ce639e193d166c8ea2216c98c3e9b701ea2cffMediumScore 53/100First seen
SHA2566298f3150ad94a242e649886d47c59c634a4d04b9af5ee15e3bf335c40b5e58eMediumScore 53/100First seen
SHA256e2a0f4440f67998a0215d49be31746ea192bfcb4dc4ee532a218f8cf13605714MediumScore 53/100First seen
SHA25640a3b969d81ef1ef35dd9ebcc6774e060b1b8949d3d74f38ca6b7d789c95cdb3MediumScore 53/100First seen
SHA256e6d8192960a89d5480868b94088cccdaa1560f9c8a0b0282ced2b7c1f72341b6MediumScore 43/100First seen
SHA2569164054d0bf0b7c8820da4f742860940998984555e65820e4fa8dd07b6bd67ecMediumScore 53/100First seen
SHA2561a2ca8b8e0344fe3d80da7352206a470245443e2349a237bc093df934ddc011fMediumScore 53/100First seen
SHA256667a8f568a611f2f3d84a366b7946b360e055bece9699c95aad619637ab72a38MediumScore 53/100First seen
SHA256b55f3b8a7334af049ba3f70a9ad3fe78574b1e180c68baf9a7110d104387a636MediumScore 53/100First seen
SHA2566da0b4c1a5d0d3fb6e6a2990a82ba51db1f68a3bba818baa46526a29731e2342MediumScore 53/100First seen
SHA2561fc23ec18a94a599a34c74ef5f49a1e27acd37a07d5846661702b5e7e81a6a24MediumScore 43/100First seen
SHA256e316b1e13154dc6115e1e0c023f6fe3d17861cae839d4a4a81779b6aad9a24f8MediumScore 53/100First seen
SHA256d8fe8f3fe838d5b1a1043096f6f6bb6f524f5f1b0c9f83a081078a824daa0cf3MediumScore 53/100First seen
SHA25680f6c010fd260d0bcf18a4b6a8d62505adbed50d2e615ed9522c4bfd61c00661MediumScore 53/100First seen
SHA25655249f296b63a8bcf911b8bc96de43c1ac2b4a56c150a19d33d892a47e57352cMediumScore 53/100First seen
SHA256b287347a5bff8af360ce0e6500c336b6fe6d97920abc26202c9d843ffebc5f89MediumScore 53/100First seen
SHA256a40bf9c75d1bfa6d66f1179f2321de6589f80d3089d992797a9cb0e84f6196ceMediumScore 53/100First seen
SHA25677417df21b4b4e8d86b8bda4afeef93fd36f355362586b2d1f51121a82244167MediumScore 53/100First seen
SHA256e1d16fb635060d23e889b0617d77f0cf06d00cc19b43a2c8b5ac53ac027ac722MediumScore 53/100First seen
SHA2562af7b513c05e76d7da5f75bb0a223c894a706c99ef2c2ddfe4eae542f95a08e0MediumScore 53/100First seen

IOC Relationship Graph

Building graph…