THREAT OPS › Threat News › New Turla Stockstay Backdoor Emerges
New Turla Stockstay Backdoor Emerges
<p class="wp-block-paragraph">The Google Threat Intelligence Group has <a href="https://cloud.google.com/blog/topics/threat-intelligence/stockstay-turla-intelligence-gathering">uncovered</a> a .NET backdoor known as STOCKSTAY, which has been a persistent component of the espionage toolkit utilized by the highly active and capable Russia-linked threat actor Turla since at least December 2022.
Attributed threat actors
- TurlaG0010
MITRE ATT&CK techniques
Indicators of compromise
- https://www.kaspersky.com/resource-center/threats/epic-turla-snake-malware-attacksurl
- https://render.com/url
- https://render.com/docs/websocketurl
Original source: https://decipher.sc/2026/06/26/new-turla-stockstay-backdoor-emerges/