Skip to content
OriginalSign in
Image: Google Cloud

Google Cloud

Google flags Turla’s STOCKSTAY backdoor aimed at Ukraine, Europe

Part of the Turla story · since 19 Sep 2025

Developinglatest 1 hour ago15 articles9 outlets
19 Sep · The Hacker News first26 Jun5 SepNowThis article8th of 15
  • Fri 19 Sep, 08:56 UTC. The Hacker News, first report. Russian Hackers Gamaredon and Turla Collaborate to Deploy Kazuar Backdoor in Ukraine.
  • Fri 19 Sep, 10:35 UTC. GBHackers, its first report on the story. Russian Hacking Groups Gamaredon and Turla Target Organizations to Deliver Kazuar Backdoor.
  • Fri 19 Sep, 13:45 UTC. SecurityWeek, its first report on the story. Turla and Gamaredon Working Together in Fresh Ukrainian Intrusions.
  • Sun 21 Sep, 18:15 UTC. Security Affairs, its first report on the story. ESET uncovers Gamaredon–Turla collaboration in Ukraine cyberattacks.
  • Thu 14 May, 15:10 UTC. Microsoft, its first report on the story. Secret Blizzard’s Kazuar malware hits govts with P2P botnet.
  • Fri 15 May, 17:50 UTC. The Hacker News. Turla’s Kazuar backdoor now powers stealthy peer to peer botnet.
  • Sat 16 May, 17:16 UTC. Security Affairs. Russian Turla Group Deploys P2P Kazuar Botnet for Stealth.
  • Thu 25 Jun, 15:32 UTC. Google Cloud, its first report on the story. Google flags Turla’s STOCKSTAY backdoor aimed at Ukraine, Europe. This article, 8th of 15.
  • Fri 26 Jun, 08:32 UTC. The Hacker News. Google uncovers Turla's STOCKSTAY backdoor targeting Ukraine.
  • Fri 26 Jun, 09:10 UTC. SecurityWeek. Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets.
  • Tue 30 Jun, 08:21 UTC. SecurityOnline, its first report on the story. STOCKSTAY malware hits Ukraine, Italy via phishing RDP exploits. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 14:38 UTC. Infosecurity, its first report on the story. New Windows Botnet Targets Victims’ AI Credits in ‘Denial-of-Wallet’ Attacks.
  • Tue 10 Nov, 11:30 UTC. The Hacker News. Turla uses Cereal malware to steal emails from Exchange servers.
  • Tue 10 Nov, 13:30 UTC. Dark Reading, its first report on the story. AI Makes Reverse Engineering Software and Malware Easier.
  • Tue 10 Nov, 15:00 UTC. Infosecurity. Turla spies on NATO and EU emails through Exchange servers.

Google Threat Intelligence Group (GTIG) published an analysis on STOCKSTAY, a .NET backdoor utilized by the Russian cyber espionage group Turla since December 2022. This backdoor targets Ukrainian government and military organizations, displaying code similarities with KAZUAR. It operates through multi-component architecture, including STOCKSTAY.STOCKBROKER for secure communication, STOCKSTAY.STOCKMARKET for task orchestration, and STOCKSTAY.STOCKTRADER for command execution.

The malware disguises as benign applications and has consistently targeted Ukrainian entities, while recent operations also show European targets, leveraging phishing emails and compromised infrastructures. The analysis was detailed through the architecture, command functionalities, operational behaviors, and a timeline of significant developments in STOCKSTAY's deployment and versatility, including its attribute to Turla.

How the story developed

All 15 articles
Developinglatest 1 hour ago15 articles9 outlets

15 articles from 9 outlets since 19 Sep. Picked up again today after 7 weeks quiet. This was the 8th report, 279 days after the first.

Now19 Sep10 May287172819 Sep51526First reportThe Hacker News · 19 Sep, 08:56This article8th of 15 · day 279
  • Fri 19 Sep, 08:56 UTC. The Hacker News, first report. Russian Hackers Gamaredon and Turla Collaborate to Deploy Kazuar Backdoor in Ukraine.
  • Fri 19 Sep, 10:35 UTC. GBHackers, its first report on the story. Russian Hacking Groups Gamaredon and Turla Target Organizations to Deliver Kazuar Backdoor.
  • Fri 19 Sep, 13:45 UTC. SecurityWeek, its first report on the story. Turla and Gamaredon Working Together in Fresh Ukrainian Intrusions.
  • Sun 21 Sep, 18:15 UTC. Security Affairs, its first report on the story. ESET uncovers Gamaredon–Turla collaboration in Ukraine cyberattacks.
  • Thu 14 May, 15:10 UTC. Microsoft, its first report on the story. Secret Blizzard’s Kazuar malware hits govts with P2P botnet.
  • Fri 15 May, 17:50 UTC. The Hacker News. Turla’s Kazuar backdoor now powers stealthy peer to peer botnet.
  • Sat 16 May, 17:16 UTC. Security Affairs. Russian Turla Group Deploys P2P Kazuar Botnet for Stealth.
  • Thu 25 Jun, 15:32 UTC. Google Cloud, its first report on the story. Google flags Turla’s STOCKSTAY backdoor aimed at Ukraine, Europe. This article, 8th of 15.
  • Fri 26 Jun, 08:32 UTC. The Hacker News. Google uncovers Turla's STOCKSTAY backdoor targeting Ukraine.
  • Fri 26 Jun, 09:10 UTC. SecurityWeek. Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets.
  • Tue 30 Jun, 08:21 UTC. SecurityOnline, its first report on the story. STOCKSTAY malware hits Ukraine, Italy via phishing RDP exploits. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 14:38 UTC. Infosecurity, its first report on the story. New Windows Botnet Targets Victims’ AI Credits in ‘Denial-of-Wallet’ Attacks.
  • Tue 10 Nov, 11:30 UTC. The Hacker News. Turla uses Cereal malware to steal emails from Exchange servers.
  • Tue 10 Nov, 13:30 UTC. Dark Reading, its first report on the story. AI Makes Reverse Engineering Software and Malware Easier.
  • Tue 10 Nov, 15:00 UTC. Infosecurity. Turla spies on NATO and EU emails through Exchange servers.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 15 articles as a list
  1. Fri 19 SepDay 03
    1. Russian Hackers Gamaredon and Turla Collaborate to Deploy Kazuar Backdoor in Ukraine08:56 · The Hacker News · First report
    2. Russian Hacking Groups Gamaredon and Turla Target Organizations to Deliver Kazuar Backdoor10:35 · GBHackers
    3. Turla and Gamaredon Working Together in Fresh Ukrainian Intrusions13:45 · SecurityWeek

  2. Quiet for 2 days

    Sun 21 SepDay 21
    1. ESET uncovers Gamaredon–Turla collaboration in Ukraine cyberattacks18:15 · Security Affairs · Picked up again

  3. Quiet for 34 weeks

    Thu 14 MayDay 2371
    1. Secret Blizzard’s Kazuar malware hits govts with P2P botnet15:10 · Microsoft · Picked up again
  4. Fri 15 MayDay 2381
    1. Turla’s Kazuar backdoor now powers stealthy peer to peer botnet17:50 · The Hacker News
  5. Sat 16 MayDay 2391
    1. Russian Turla Group Deploys P2P Kazuar Botnet for Stealth17:16 · Security Affairs

  6. Quiet for 6 weeks

    Thu 25 JunDay 2791
    1. Google flags Turla’s STOCKSTAY backdoor aimed at Ukraine, Europe15:32 · Google Cloud · Picked up again · This article, 8th of 15
  7. Fri 26 JunDay 2802
    1. Google uncovers Turla's STOCKSTAY backdoor targeting Ukraine08:32 · The Hacker News
    2. Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets09:10 · SecurityWeek

  8. Quiet for 4 days

    Tue 30 JunDay 2841
    1. STOCKSTAY malware hits Ukraine, Italy via phishing RDP exploits08:21 · SecurityOnline · Exploited CVE · Picked up again · Known exploited CVE

  9. Quiet for 12 weeks

    Wed 23 SepDay 3691
    1. New Windows Botnet Targets Victims’ AI Credits in ‘Denial-of-Wallet’ Attacks14:38 · Infosecurity · Picked up again

  10. Quiet for 7 weeks

    Tue 10 NovDay 4173
    1. Turla uses Cereal malware to steal emails from Exchange servers11:30 · The Hacker News · Picked up again
    2. AI Makes Reverse Engineering Software and Malware Easier13:30 · Dark Reading
    3. Turla spies on NATO and EU emails through Exchange servers15:00 · Infosecurity

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in