Turla group adds more malware to Russia’s espionage efforts against Ukraine

Google researchers report that Turla (aka Secret Blizzard/Venomous Bear) has developed and deployed a covert malware family named StockStay since at least December 2022 to conduct espionage against Ukrainian government and military organizations and select European targets; the malware mimics legitimate applications, reuses code from the Kazuar framework, and the group distributed it via phishing messages that included malicious RDP configuration files and diplomatic/academic-themed lures.