STOCKSTAY: Turla's New.NET Backdoor

Google Threat Intelligence Group analyzed STOCKSTAY, a.NET backdoor deployed by Russia-linked threat actor Turla since December 2022. The malware targets government and military organizations in Ukraine and entities interested in Italian foreign policy. STOCKSTAY shares code overlaps with Turla's KAZUAR toolkit and communicates via secure WebSocket.