STOCKSTAY Another Day: The Latest Addition to Turla’s Intelligence Gathering Apparatus

#### Executive summary: This GTIG report details the STOCKSTAY malware ecosystem — a multi-component, .NET-based toolkit used in phishing campaigns (notably via malicious RDP files) targeting Ukrainian government and military organizations and, to a lesser extent, European entities. The report describes operational techniques (environmental keying, staged deployments, use of compromised infrastructure), technical links and tool-sharing with the KAZUAR ecosystem (shared obfuscation primitives and componentized architecture), and provides a development timeline and IOCs to assist detection and hunting.