MalwarePublished 26 Jun 2026

Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets

Source SecurityWeek

Mentions 1 CVE

Mentioned vulnerabilities

CVE-2025-8088

Description

Turla has been using the backdoor against government and military organizations in Ukraine for espionage. The post Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets appeared first on SecurityWeek .

Impact

StockStay enables persistent cyber espionage by allowing attackers to execute arbitrary commands, exfiltrate data, capture screens, modify system settings, and maintain covert access within targeted Ukrainian government and military networks. The backdoor’s use of secure WebSocket communication and proxy-aware tunneling complicates detection and network defense. The exploitation of a known vulnerability (CVE-2025-8088) and use of phishing with malicious RDP files increase the risk of initial compromise. The campaign supports Russian intelligence objectives by targeting sensitive governmental and military information.

Defensive guidance

Organizations should monitor for phishing attempts leveraging academic and diplomatic themes, scrutinize RDP configuration files received via email, and apply security controls to detect exploitation of CVE-2025-8088. Incident response teams should investigate any signs of StockStay components or related activity within their environments.

Summary

Turla, a Russia-linked APT group active since at least 2004 and officially tied to Russia’s FSB, has developed and deployed a multi-component .NET backdoor called StockStay since 2022. StockStay uses secure WebSocket connections via the websocket-sharp library for C2 communication and includes components for downloading payloads, tunneling network traffic, and orchestrating malware execution. It masquerades as stock market tools, PDF viewers, or calculator utilities. The backdoor supports commands for file download, exfiltration, modification, screen capture, registry changes, process execution, and system information harvesting. Deployment methods include phishing emails with malicious RDP files and exploitation of CVE-2025-8088. The primary targets are Ukrainian government and military organizations, with some activity against European entities linked to foreign policy interests. The malware campaign uses themes related to academia and diplomacy for social engineering and has leveraged compromised local infrastructure for deployment.

References

securityweek.com/russian-apt-deploys-stockstay-backdoor-against-ukrainian-targets/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 26 Jun 2026, 09:01 UTC

References

Community reviews

Related threats