Turla Hackers Use STOCKSTAY .NET Backdoor to Spy on Ukrainian Government and Military Targets

The Russian state-sponsored threat actor Turla, publicly attributed to Russia’s Federal Security Service (FSB), is actively deploying a sophisticated .NET backdoor tracked as STOCKSTAY. Google Threat Intelligence Group (GTIG) discovered that this malware is primarily used to conduct ongoing cyber espionage against Ukrainian government and military organizations, alongside entities involved in Italian foreign policy. Turla STOCKSTAY Targets Ukraine STOCKSTAY is a highly…

Diamond Model