Turla’s STOCKSTAY Backdoor: A New .NET Spy Tool

Google Threat Intelligence Group (GTIG) has uncovered STOCKSTAY, a .NET backdoor used by the Russia-linked threat actor Turla since at least December 2022. This multi-component malware targets government and military organizations in Ukraine and entities interested in Italian foreign policy. Think of it as a sneaky caiman lurking in the swamp, but instead of snapping jaws, it uses encrypted WebSocket connections to exfiltrate data.

What is STOCKSTAY?

STOCKSTAY is a modular backdoor written in .NET, disguised as a stock market data viewer. It communicates via secure WebSocket connections and consists of three main components:

• STOCKSTAY.STOCKBROKER: A proxy-aware tunneler that handles all network communication, acting as a relay between the C2 server and the orchestrator.
• STOCKSTAY.STOCKMARKET: The orchestrator that manages configuration, encryption, and task distribution. It generates a unique RSA key pair and infection ID.
• STOCKSTAY.STOCKTRADER: The backdoor component that executes commands like file operations, registry edits, screen captures, and process execution.

How It Operates

STOCKSTAY uses a configuration file disguised as legitimate cryptocurrency market data. The malware employs environmental keying, requiring specific hostnames or domains to decrypt its config. It also uses a custom string obfuscation mechanism called K1MORPHER, which it shares with Turla’s KAZUAR toolkit. This suggests a common developer or team behind both.

Key Operational Characteristics

• Academic and diplomatic lures: The actor uses compromised university emails and diplomatic-themed platforms for phishing.
• Persistent Ukrainian targeting: Most operations focus on Ukrainian government and military entities.
• Deployment via malicious RDP files and HTA: Victims are lured into connecting to actor-controlled infrastructure.
• Use of legitimate services: C2 servers are hosted on platforms like Render and GitHub to blend in.

Overlaps with KAZUAR

STOCKSTAY shares significant code and architectural similarities with Turla’s KAZUAR toolkit, including the K1MORPHER obfuscation and multi-component design. GTIG assesses with moderate confidence that the same developers are behind both, with STOCKSTAY being developed in KAZUAR’s image.

Timeline of Activity

GTIG tracked STOCKSTAY from early samples in 2022 through active operations in 2025. Notable events include:

• September 2023: Early version uploaded from Germany.
• January 2024: Deployed alongside KAZUAR in a Ukrainian network.
• February 2024: Italian-themed MSI installer targeting foreign affairs.
• March-April 2025: Phishing campaign using compromised Ukrainian university email.
• November 2025: Drone-themed lures exploiting WinRAR vulnerability CVE-2025-8088.

Attribution

GTIG attributes STOCKSTAY to Turla with high confidence based on code overlaps with KAZUAR, use of Windows-1251 encoding, and shared infrastructure. Turla is a known FSB-linked group active since at least 2004.

Detection and Mitigation

GTIG provides YARA rules and Google SecOps detection rules to identify STOCKSTAY components. Organizations should monitor for suspicious WebSocket connections, especially to Render-hosted domains, and educate users about phishing lures related to military or diplomatic topics.

For more on securing your backend, check out our reviews of Supabase and Neon Database.

Original announcement published on Google Cloud.