Google Details Turla's New STOCKSTAY Backdoor Used in Ukraine Espionage Attacks

Google Threat Intelligence attributes a previously undocumented multi-component .NET backdoor named STOCKSTAY to the Turla APT, describing its downloader (MARKETMAKER), core modules (STOCKBROKER, STOCKTRADER, STOCKMARKET), WebSocket-based encrypted C2, IPC via WM_COPYDATA, and a broad set of espionage capabilities; the report details distribution vectors including phishing with malicious RDP/HTA/MSI, exploitation of CVE-2025-8088, use of compromised WordPress sites, overlaps with the Kazuar toolkit, and observed targeting of Ukrainian government and military organizations and entities tied to Italian foreign policy.