Google Details Turla’s New STOCKSTAY Backdoor Used in Ukraine Espionage Attacks

Google Threat Intelligence Group (GTIG) has attributed a previously undocumented .NET backdoor named STOCKSTAY to the Russian state-sponsored threat actor Turla. The malware has been deployed against government and military organizations in Ukraine, as well as entities with an interest in Italian foreign policy.

STOCKSTAY is a multi-component backdoor written in .NET using the Windows Forms framework. It communicates with its command-and-control (C2) server via a secure WebSocket connection using the open-source websocket-sharp library. The implant was originally designed to mimic a stock market data viewing tool before being adapted to masquerade as PDF viewers and calculator utilities.

The backdoor consists of several components: STOCKSTAY.MARKETMAKER (a downloader), STOCKSTAY.STOCKBROKER (a proxy-aware tunneler), STOCKSTAY.STOCKTRADER (the main backdoor for information gathering), and STOCKSTAY.STOCKMARKET (an orchestrator). STOCKSTAY shares significant code and functional overlaps with Kazuar, a staple implant used by Turla since 2017.

Attacks distributing STOCKSTAY have used academic- or diplomatic-themed lures. In early 2025, Turla employed phishing emails with malicious RDP file attachments. By November 2025, a phishing wave targeting Ukraine delivered the implant via RAR archives exploiting CVE-2025-8088, a WinRAR vulnerability also exploited by Sandworm, Gamaredon, and RomCom. Other campaigns have used MSI installers and RAR files containing HTA scripts.

Google identified a publicly accessible GitHub repository containing a Python implementation of the STOCKSTAY WebSocket server controller. The malware has been used by Turla at multiple stages of operations, including initial access and post-exploitation.