Turla, a Russia-linked APT group active since at least 2004 and officially tied to Russia’s FSB, has developed and deployed a multi-component .NET backdoor called StockStay since 2022. StockStay uses secure WebSocket connections via the websocket-sharp library for C2 communication and includes components for downloading payloads, tunneling network traffic, and orchestrating malware execution. It masquerades as stock market tools, PDF viewers, or calculator utilities. The backdoor supports commands for file download, exfiltration, modification, screen capture, registry changes, process execution, and system information harvesting. Deployment methods include phishing emails with malicious RDP files and exploitation of CVE-2025-8088. The primary targets are Ukrainian government and military organizations, with some activity against European entities linked to foreign policy interests. The malware campaign uses themes related to academia and diplomacy for social engineering and has leveraged compromised local infrastructure for deployment.

StockStay enables persistent cyber espionage by allowing attackers to execute arbitrary commands, exfiltrate data, capture screens, modify system settings, and maintain covert access within targeted Ukrainian government and military networks. The backdoor’s use of secure WebSocket communication and proxy-aware tunneling complicates detection and network defense. The exploitation of a known vulnerability (CVE-2025-8088) and use of phishing with malicious RDP files increase the risk of initial compromise. The campaign supports Russian intelligence objectives by targeting sensitive governmental and military information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations should monitor for phishing attempts leveraging academic and diplomatic themes, scrutinize RDP configuration files received via email, and apply security controls to detect exploitation of CVE-2025-8088. Since no official fix or patch information is provided, defensive measures should focus on user awareness, network monitoring for unusual WebSocket traffic, and restricting unauthorized RDP access. Incident response teams should investigate any signs of StockStay components or related activity within their environments.