Turla Deploys New STOCKSTAY Backdoor in Ukraine Espionage Operations

Overview of the STOCKSTAY Campaign

Google Threat Intelligence has identified a new APT operation attributed to Turla—also known as TAG-70 or KRYPTON—deploying a previously undocumented backdoor dubbed STOCKSTAY. This campaign focuses heavily on strategic targets in Ukraine and entities involved with Italian foreign policy. According to The Hacker News, this Windows-based backdoor represents a continued evolution of the group’s toolkit designed for long-term intelligence gathering and persistence within sensitive environments.

Technical Analysis: STOCKSTAY Backdoor Capabilities

STOCKSTAY is a .NET-based malware that provides the attackers with extensive control over the compromised host. As a persistent backdoor, it allows Turla operators to execute arbitrary commands, manage files, and exfiltrate sensitive data to their C2 infrastructure. Analysis reveals the malware is in active development, with various iterations observed in the wild, suggesting the threat actor is fine-tuning the tool to evade signature-based detection.

Russian Espionage Tactics Against Ukraine Gov

The deployment of STOCKSTAY against Ukrainian government and military organizations highlights the persistent threat posed by Russian state-sponsored TTPs. Unlike noisier Ransomware operations, Turla’s primary objective remains stealth. By leveraging .NET, the malware can blend in with legitimate administrative tools and processes often found on Windows servers and workstations. This makes it particularly challenging for a SOC to identify without specialized EDR solutions or behavioral monitoring.

The targeting of entities interested in Italian foreign policy suggests that Turla is expanding its scope to include European diplomatic and geopolitical interests. This expansion likely seeks to gain insights into international support for Ukraine, shifts in Mediterranean regional policy, or broader European Union diplomatic strategy.

Detect Turla STOCKSTAY Backdoor on Windows

Detecting STOCKSTAY requires a multi-layered approach to monitoring system behavior. Because STOCKSTAY relies on the .NET framework, defenders should monitor for unusual csc.exe or cvtres.exe activity, which may indicate the just-in-time compilation or execution of malicious payloads. Furthermore, visibility into PowerShell and command-line arguments is essential for identifying the initial stages of infection.

STOCKSTAY Malware Indicators of Compromise

Security teams should look for several IoC patterns associated with this campaign. While specific file hashes often change due to frequent updates, behavioral anomalies remain more consistent. Key indicators of STOCKSTAY activity include:

• Unusual Outbound Traffic: Network connections to non-standard domains or IP addresses associated with known Turla infrastructure, often utilizing HTTP/HTTPS for C2 communication.
• Persistence Mechanisms: New scheduled tasks or registry run keys pointing to obscurely named .NET binaries or scripts.
• Process Injection: Evidence of code injection or unusual child processes spawning from common Windows utilities like svchost.exe or explorer.exe.

Defenders should map these behaviors against the MITRE ATT&CK framework, specifically focusing on Command and Scripting Interpreter (T1059) and System Services: Service Execution (T1569.002).

Mitigation and Defensive Recommendations

To defend against STOCKSTAY and similar state-sponsored threats, organizations must adopt a Zero Trust security model that assumes breach and validates every access request across the network.

1. Endpoint Protection: Deploy and properly configure EDR tools to alert on suspicious .NET execution. Ensure that logging for AMSI (Antimalware Scan Interface) is enabled to intercept malicious scripts at runtime.
2. Network Segmentation: Implement strict egress filtering to prevent unauthorized C2 communication. High-value systems containing military or diplomatic intelligence should be isolated from general internet access where possible.
3. Threat Hunting: Conduct regular hunts for IoC patterns across the environment. Focus on identifying Lateral Movement attempts that typically follow the initial backdoor installation, such as the use of WMI or SMB for internal propagation.
4. Credential Hygiene: Enforce multi-factor authentication (MFA) across all administrative accounts to prevent attackers from using Privilege Escalation to widen their access after the initial STOCKSTAY compromise.