Russia-Linked Turla Uses Compromised Infrastructure to Deploy STOCKSTAY in Ukraine Operations

Russia-linked threat group Turla has been quietly expanding its espionage arsenal with a new backdoor called STOCKSTAY, actively targeting government and military organizations in Ukraine since at least December 2022. The malware is built in .NET and communicates with operators through a secure WebSocket connection, making it difficult to detect within normal network traffic. Evidence […]

The post .