Signal
Turla deploys new StockStay backdoor in espionage targeting Ukraine and Italy
Evidence first: scan the strongest sources, then decide whether to go deeper.
Published 2026-06-26 07:15 UTCUpdated 2026-06-26 22:03 UTC
rss
cveexploitsmalwarethreat_actorsincident_response
Source links open
Source links and full evidence are open here. Archive history, compare-over-time, alerts, exports, API, integrations, and workflow are paid.
No card needed for the free brief.
Evidence trail (top sources)
top sources (4 domains)domains are deduped. counts indicate coverage, not truth.4 top sources shown
Overview
The Russian state-sponsored threat actor Turla has developed and deployed a new .NET-based backdoor named StockStay against government and military targets in Ukraine, as well as entities linked to Italian foreign policy.
Entities
Google Threat Intelligence GroupStockStay
Score total
1.46
Momentum 24h
4
Posts
4
Origins
4
Source types
1
Duplicate ratio
0%
Why now
- StockStay is a newly documented backdoor actively deployed in current conflicts.
- Recent disclosures by multiple cybersecurity sources provide fresh intelligence.
- Understanding this malware aids timely defense against evolving Russian cyber operations.
Why it matters
- Highlights ongoing Russian cyber-espionage efforts targeting Ukraine and allied interests.
- Reveals use of advanced malware techniques like secure WebSocket communication for stealth.
- Informs defenders about a new threat actor tool for improved detection and response.
LLM analysis
Topic mix: lowPromo risk: lowSource quality: high
Recurring claims
- Turla has deployed a new .NET backdoor named StockStay against Ukrainian government and military targets.
- StockStay communicates with its command-and-control servers via secure WebSocket connections.
How sources frame it
- Google Threat Intelligence Group: neutral
All evidence
All evidence
Turla group deploys new STOCKSTAY backdoor against Ukraine and Italy
SC Media · scworld.com · 2026-06-26 22:03 UTC
Turla group adds more malware to Russia’s espionage efforts against Ukraine
The Record (Recorded Future News) · therecord.media · 2026-06-26 13:30 UTC
Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets
SecurityWeek · securityweek.com · 2026-06-26 08:55 UTC
Google Details Turla's New STOCKSTAY Backdoor Used in Ukraine Espionage Attacks
thehackernews · thehackernews.com · 2026-06-26 07:15 UTC
Show filters & breakdown
Posts loaded: 0Publishers: 4Origin domains: 4Duplicates: -
Showing 4 / 0
Top publishers (this list)
- SC Media (1)
- The Record (Recorded Future News) (1)
- SecurityWeek (1)
- thehackernews (1)
Top origin domains (this list)
- scworld.com (1)
- therecord.media (1)
- securityweek.com (1)
- thehackernews.com (1)