CyberSecurityBoardThreat Intel · CVEs · Products
Cyber Products

WordPress: Compromised Instances Used in Turla Operations

June 25, 2026

WordPress instances have been compromised by Turla to host ZIP archives containing STOCKSTAY components. Both STOCKSTAY and Kazuar have been observed using compromised WordPress sites during various stages of their operations.