Introduction
Russia-linked Turla weaponizes trusted sites and compromised infrastructure to support long-running espionage campaigns. Google Threat Intelligence Group linked Russia-linked Turla to STOCKSTAY, a .NET backdoor used against Ukrainian government and military organizations, as well as entities connected to Italian foreign policy interests.
Google Threat Intelligence Group has attributed a previously undocumented.NET backdoor called STOCKSTAY to Turla. The group is also tracked as SUMMIT, Secret Blizzard, VENOMOUS BEAR, and UAC-0194.
Turla deployed STOCKSTAY against government and military organizations in Ukraine. Google also confirmed activity involving entities connected to Italian foreign policy interests.
This campaign matters because Turla does not depend only on attacker-owned servers. Instead, the group uses compromised infrastructure, trusted platforms, phishing lures, and modular malware to stay hidden for long periods.
As a result, defenders cannot rely only on known-bad domain lists. They need behavioral detection, stronger egress monitoring, and threat hunting that looks for suspicious activity hiding behind legitimate infrastructure.
For related context on attackers abusing trusted platforms, see Digital Warfare’s trusted platform command and control analysis
How Russia-linked Turla Weaponizes Trusted Sites
Turla compromised infrastructure gives the group a major operational advantage. It helps the attackers hide malicious activity behind systems that defenders may already trust.
For example, a compromised WordPress site does not always look suspicious at first glance. It may have a clean reputation, normal web traffic, and a legitimate history. Therefore, traffic to that site may bypass simple reputation-based blocking.
This is exactly why the technique works. Turla can stage malware, route traffic, and slow down takedowns without exposing its real command infrastructure too quickly.
In addition, compromised infrastructure complicates attribution. If defenders find a hijacked website, they still need to determine who controls the activity behind it. That delay gives Turla more time to maintain access.
Why Russia-linked Turla Uses Compromised Infrastructure
Google Threat Intelligence Group described STOCKSTAY as a .NET backdoor that Turla has developed and deployed since at least December 2022.
The malware supports ongoing cyber espionage. It gives operators a way to maintain access, run commands, move data, and communicate through secure WebSocket channels.
Google also found significant code and functional overlap between STOCKSTAY and KAZUAR. KAZUAR is another Turla malware framework that the group has used in previous espionage campaigns.
This overlap matters because it shows continuity. Turla is not simply replacing old tools. Instead, it appears to be building parallel malware ecosystems. If defenders remove one tool, another may remain active.
Therefore, any discovery of STOCKSTAY should trigger a wider Turla investigation. Teams should also look for KAZUAR, earlier access activity, credential theft, lateral movement, and command infrastructure.
How Russia-linked Turla Delivers STOCKSTAY
Turla uses several delivery paths for STOCKSTAY. The group has used phishing emails with malicious RDP files. It has also used RAR archives, MSI installers, and HTML Application scripts.
In one observed path, the victim opens a malicious Remote Desktop Protocol file. That file connects the victim’s system to actor-controlled infrastructure. After that, the attackers can deploy additional payloads.
In another path, attackers use archive files linked to CVE-2025-8088 exploitation. This technique gives Turla another way to reach targets that trust compressed files or receive documents through normal business workflows.
Once the first stage succeeds, STOCKSTAY components can download from compromised infrastructure. This may include hijacked WordPress sites or other trusted-looking web services.
Because of this layered approach, defenders need visibility across email, endpoint, DNS, proxy logs, archive handling, RDP activity, and outbound WebSocket traffic.
Russia-linked Turla STOCKSTAY Architecture
STOCKSTAY uses a modular design. This makes the malware more flexible and harder to understand from a single artifact.
The backdoor is written in .NET and uses the Windows Forms framework. It communicates with command-and-control infrastructure through secure WebSocket connections. Google also notes that it uses the open-source websocket-sharp library.
The malware includes three main components.
STOCKSTAY.STOCKMARKET acts as the orchestrator. It coordinates the broader implant operation and manages interaction between the other modules.
STOCKSTAY.STOCKBROKER handles tunneling and communication. It manages server details, receives WebSocket messages, and routes traffic between the victim system and command infrastructure.
STOCKSTAY.STOCKTRADER handles command execution. It receives attacker instructions and executes them on the compromised host.
This design gives Turla separation of function. As a result, each module can perform a specific role while the full implant remains adaptable.
How Russia-linked Turla Hides Command Infrastructure
STOCKSTAY does not expose Turla’s real infrastructure directly. Instead, it uses layers that make investigation harder.
Google identified a publicly accessible GitHub repository containing a Python implementation of the victim-facing STOCKSTAY WebSocket server controller. This controller handles inbound messages from connected clients and logs IP information.
However, the server cannot decrypt inbound messages. This limits visibility for platform operators and makes it harder to inspect the real command flow.
This structure resembles Turla’s multi-hop command-and-control tradecraft. Even if defenders find one server, they may not reach the backend infrastructure that the operators control.
Therefore, incident responders should avoid assuming that one takedown or one blocked domain removes the threat. Turla often builds infrastructure in layers.
Russia-linked Turla Delivery Methods
Turla has used multiple delivery methods for STOCKSTAY. Each method targets a different trust relationship.
First, the group uses malicious RDP files. These files can look like legitimate remote access configuration files, especially in organizations where remote administration is common.
Next, Turla uses archive-based delivery. Public reporting links at least one campaign to RAR archives exploiting CVE-2025-8088, a WinRAR vulnerability also used by other Russia-linked groups.
In addition, campaigns have used MSI installers and HTML Application scripts. These file types can bypass user suspicion when they appear inside trusted academic, diplomatic, or administrative workflows.
Because Turla changes delivery methods, defenders should not build controls around one file type only. Instead, they should monitor the full chain from email lure to endpoint execution and outbound communication.
For related remote access tradecraft, see Digital Warfare’s Cloud Atlas APT stealth RDP persistence analysis
Environmental Keying in the STOCKSTAY Campaign
Environmental keying is one of the most important details in this campaign. Turla does not always deploy STOCKSTAY blindly.
Instead, Google’s reporting shows that the group may deploy the implant after it already understands the target environment. This means the attackers likely know which machine they want to hit before they install the backdoor.
That changes the meaning of detection. If a team finds STOCKSTAY, the intrusion may already be mature. The attacker may have spent weeks or months mapping the environment.
Therefore, responders should investigate backward. They should review initial phishing, RDP activity, credential access, lateral movement, archive execution, KAZUAR indicators, and WordPress staging downloads.
The final implant is only one part of the story. The earlier access path may reveal the real scale of compromise.
Russia-linked Turla Timeline
Google says STOCKSTAY development dates back to at least December 2022. That timeline shows deliberate investment rather than one-off malware development.
Early activity appeared in European contexts, including Italy, the Netherlands, Poland, and Germany. Later activity focused heavily on Ukrainian government and military targets.
By early 2025, Turla used malicious RDP phishing activity against Ukrainian targets. Later, in November 2025, phishing activity targeting Ukraine reportedly delivered STOCKSTAY through RAR archives linked to CVE-2025-8088 exploitation.
In June 2026, Google Threat Intelligence Group publicly documented STOCKSTAY and attributed it to Turla.
This timeline shows a campaign that evolved over several years. It also shows that Turla continued adapting delivery methods while maintaining its long-term espionage mission.
Who Russia-linked Turla Targets With STOCKSTAY
Turla primarily targets Ukrainian government and military organizations in this campaign. This aligns with Russia’s intelligence priorities and Turla’s historic focus on government, defense, and diplomatic targets.
However, the campaign reaches beyond Ukraine. Google also identified activity involving entities with an interest in Italian foreign policy. Early STOCKSTAY samples also appeared in Italy, the Netherlands, Poland, and Germany.
These targets suggest a broader intelligence collection mission. Turla appears interested in organizations tied to diplomacy, defense, policy, research, and Ukraine-related geopolitical activity.
As a result, organizations in NATO-aligned countries should treat this campaign seriously if they support defense, government, foreign policy, critical infrastructure, or Ukraine-adjacent operations.
Why Academic and Diplomatic Lures Work
Turla repeatedly uses academic and diplomatic themes because those themes exploit trust.
A message from a university account may look normal to a government analyst, researcher, or policy official. Similarly, a file from a diplomatic platform may appear relevant to an official working on international affairs.
This is not only a technical attack. It is a social attack against professional trust networks.
Therefore, awareness training should cover these themes directly. Government, defense, and diplomatic staff should know that trusted institutions can become delivery channels for malicious files.
Email filtering also needs context. A trusted sender does not automatically mean a safe attachment.
Enterprise and Government Impact
STOCKSTAY creates serious risk for government, defense, diplomatic, and critical infrastructure environments.
For Ukrainian government and defense organizations, the malware may indicate a long-running intrusion. Turla often deploys advanced implants after it already has meaningful access.
For European diplomatic and policy organizations, the campaign confirms that Ukraine-related and Italian foreign policy interests remain relevant targets.
For critical infrastructure operators, the risk may be indirect but still important. Turla has a long history of targeting high-value geopolitical sectors. Organizations that support national security or government operations should increase threat hunting.
In addition, all enterprises should learn from the campaign. Attackers can use legitimate infrastructure, familiar file types, and trusted sender accounts to bypass basic controls.
Real-World Attack Scenarios
In a university phishing bridge scenario, attackers compromise a trusted academic account. They then send targeted emails to government-adjacent recipients. The email looks legitimate, and the victim opens a malicious RDP file. After that, the workstation connects to attacker-controlled infrastructure, and STOCKSTAY components download from a compromised site.
In a diplomatic platform abuse scenario, attackers use a trusted diplomatic education platform to distribute malicious files. The platform’s reputation helps the payload reach recipients. As a result, security tools may treat the activity as lower risk.
In a late-stage deployment scenario, Turla first gains access with another tool such as KAZUAR. Operators quietly map the network and identify a valuable workstation. Then they deploy STOCKSTAY to that machine and use STOCKTRADER to execute commands.
These scenarios reflect the campaign patterns described in public reporting. They show how the confirmed tactics can work inside real environments.
How to Defend Against Russia-linked Turla Attacks
Defending against STOCKSTAY requires controls across email, endpoint, network, and identity systems.
First, organizations should block or quarantine RDP file attachments unless there is a clear business requirement. Malicious RDP files are a confirmed delivery path.
Next, teams should patch archive tools, especially WinRAR, and inspect compressed files more aggressively. Archive-based delivery remains a common method for espionage groups.
In addition, defenders should monitor outbound WebSocket traffic, unusual .NET execution, unexpected WordPress downloads, and suspicious RDP-initiated activity.
Most importantly, teams should treat compromised infrastructure as part of the threat model. A clean reputation score does not prove that traffic is safe.
Block Malicious RDP Attachments
RDP files can create direct paths from a victim workstation to attacker-controlled infrastructure. Therefore, email gateways should block or quarantine .rdp attachments by default.
If a business truly needs RDP files, security teams should allow them only through approved workflows. They should also log and review every accepted file.
Endpoint controls should warn users clearly before opening remote connection files. In high-risk environments, users should not open external RDP files at all.
Security teams should also monitor for unusual RDP launches from email clients, browsers, archive tools, or temporary directories.
Patch CVE-2025-8088 and Strengthen Archive Controls
Turla has used archive-based delivery in this campaign. Therefore, organizations should patch WinRAR and related archive tools without delay.
Security teams should also inspect RAR, ZIP, ISO, IMG, and other container formats at the email gateway and endpoint level.
Archive files from academic, diplomatic, government, and foreign policy sources should not bypass inspection simply because the sender looks trusted.
In addition, teams should monitor archive extraction followed by script execution, RDP file launches, MSI execution, or unexpected .NET activity.
Hunt for STOCKSTAY Behavior
Threat hunters should look for unexpected WebSocket connections from workstations to external hosts. They should also review unusual .NET process activity, especially when the process uses Windows Forms in an unexpected context.
Teams should investigate outbound connections to unfamiliar WordPress domains, especially when those connections download ZIP files or appear after phishing activity.
Hunters should also review registry persistence entries that mimic Microsoft update components. In addition, they should examine named pipe activity, inter-process communication patterns, and unusual command execution linked to WebSocket traffic.
Because STOCKSTAY may appear late in an intrusion, hunters should search for earlier activity as well. This includes RDP lures, archive exploitation, credential access, and KAZUAR indicators.
Monitor WordPress and Trusted Platform Traffic
Turla compromised infrastructure often hides inside legitimate-looking web services. Therefore, defenders should monitor trusted platforms more carefully.
The goal is not to block all WordPress traffic. Instead, teams should identify abnormal patterns. A workstation downloading ZIP archives from an unknown WordPress site may require investigation.
DNS filtering, proxy inspection, and egress policies should flag unusual destinations, new download patterns, and connections that do not match user behavior.
Likewise, teams should review GitHub and other trusted platform traffic when it appears in unusual malware delivery or command flows.
Deploy Behavioral EDR on High-Risk Endpoints
Signature-based detection may miss STOCKSTAY during early exposure. The malware is new, actively developed, and designed to blend into normal network traffic.
Behavioral EDR should detect suspicious process chains, unusual .NET execution, WebSocket tunneling, and lateral movement.
Government, defense, diplomatic, research, and critical infrastructure endpoints should receive the strongest monitoring. These environments match Turla’s targeting profile more closely.
In addition, EDR alerts should feed into threat hunting workflows. A single suspicious process may look minor, but the full chain may reveal an espionage operation.
Use Network Segmentation to Limit Damage
Turla often deploys advanced tools after gaining meaningful access. Network segmentation limits the damage when that happens.
Organizations should separate high-value systems from ordinary workstation segments. They should also restrict access to sensitive military, diplomatic, policy, and research data.
Identity controls matter as well. Privileged access should require strong authentication, strict role separation, and continuous monitoring.
Segmentation will not stop every attack, but it can slow movement and make suspicious behavior easier to detect.
For broader defensive validation, see Digital Warfare’s vulnerability assessment services
Broader Security Lessons From Russia-linked Turla
This campaign offers lessons beyond Turla.
First, compromised third-party infrastructure remains a major detection blind spot. Attackers use it because defenders often trust it.
Second, parallel malware ecosystems give advanced groups resilience. If defenders find one implant, another tool may still support the mission.
Third, late-stage implants require backward investigation. Teams should not treat STOCKSTAY as the start of the intrusion. They should treat it as evidence that earlier access may already exist.
Finally, academic and diplomatic lures deserve special attention. These themes exploit real trust relationships in government and policy communities.
Why Reputation-Based Detection Is Not Enough
Reputation-based tools can help, but they cannot solve this problem alone.
A compromised WordPress site may have a legitimate history. A trusted platform may host attacker-controlled code. A known institution may send malicious content after account compromise.
Therefore, defenders need behavior-based detection. They must ask what the system is doing, not only whether the domain looks clean.
This means monitoring downloads, process chains, RDP launches, WebSocket traffic, archive behavior, and unusual outbound connections.
Why STOCKSTAY Signals Deeper Compromise
STOCKSTAY may appear late in an operation. That makes it dangerous.
If defenders find the backdoor, they should assume the attacker may already know the environment. The group may have mapped systems, stolen credentials, and selected high-value machines.
Therefore, response teams should widen the investigation immediately. They should review authentication logs, lateral movement, endpoint history, email delivery, DNS activity, and proxy records.
Removing the malware matters. However, understanding how Turla got there matters more.
Key Takeaway on Russia-linked Turla
Russia-linked Turla uses compromised infrastructure to stage, deliver, and control STOCKSTAY, a .NET backdoor built for long-term espionage.
Google Threat Intelligence Group confirms that Turla has developed and deployed STOCKSTAY since at least December 2022. The group has used it against Ukrainian government and military organizations, plus entities linked to Italian foreign policy interests.
The malware overlaps with KAZUAR, uses secure WebSocket communication, and relies on modular components for orchestration, tunneling, and command execution.
The campaign shows why defenders must monitor trusted infrastructure, block malicious RDP files, patch archive tools, inspect WebSocket behavior, and treat late-stage implants as signs of deeper compromise.
What Organizations Should Do Now
Organizations should first decide whether their mission aligns with Turla targeting. Government, military, diplomatic, defense, research, critical infrastructure, and Ukraine-adjacent organizations should escalate this campaign into active threat hunting.
Next, email gateways should block or quarantine RDP attachments. They should also inspect archive files more aggressively.
Then, endpoint teams should update WinRAR and related archive tools. They should also monitor suspicious .NET execution, RDP launches, and WebSocket connections.
Finally, incident responders should treat STOCKSTAY as a late-stage compromise signal. If they find it, they should investigate earlier access, KAZUAR activity, lateral movement, credential theft, and command infrastructure.
For the one external source in this article, review Google Threat Intelligence Group’s official report: STOCKSTAY Another Day: The Latest Addition to Turla’s Intelligence-Gathering Toolset.
Frequently Asked Questions About Russia-linked Turla
What Is STOCKSTAY?
STOCKSTAY is a multi-component .NET backdoor attributed by Google Threat Intelligence Group to Turla. The group has used it for cyber espionage against Ukrainian government and military organizations and entities connected to Italian foreign policy interests.
How Does Russia-Linked Turla Use Compromised Infrastructure?
Russia-linked Turla uses compromised infrastructure such as hijacked WordPress sites and trusted platforms to stage malware, deliver components, and hide command activity behind legitimate-looking traffic.
Who Does Turla Target With STOCKSTAY?
Turla targets Ukrainian government and military organizations. Google also confirmed activity involving entities tied to Italian foreign policy interests, with early samples seen in Italy, the Netherlands, Poland, and Germany.
How Does STOCKSTAY Reach Victims?
STOCKSTAY reaches victims through phishing and staged delivery. Observed methods include malicious RDP files, RAR archives linked to CVE-2025-8088 exploitation, MSI installers, and HTML Application scripts.
How Is STOCKSTAY Related to KAZUAR?
Google reports that STOCKSTAY shares significant code and functional overlap with KAZUAR. This suggests Turla built STOCKSTAY with knowledge from its older malware ecosystem while keeping multiple tools active.
Why Is Turla Compromised Infrastructure Hard to Detect?
Turla compromised infrastructure is hard to detect because traffic may flow through legitimate websites or trusted platforms. Encrypted WebSocket communication can also blend with normal HTTPS traffic.
What Is Environmental Keying?
Environmental keying means the malware runs or deploys only in specific target conditions. In this campaign, STOCKSTAY may appear after Turla has already identified a specific machine inside a compromised environment.
How Should Organizations Defend Against STOCKSTAY?
Organizations should block RDP attachments, patch CVE-2025-8088, inspect suspicious archives, monitor WebSocket traffic, hunt for unusual .NET activity, restrict unknown WordPress downloads, deploy behavioral EDR, and segment high-value systems.
