Mandiant (Google)Published
The Latest Addition to Turla’s Intelligence Gathering Apparatus
By Google Threat Intelligence Group
Excerpt
Written by: Jordan Jones
Introduction
Google Threat Intelligence Group (GTIG) has conducted an in-depth analysis of a .NET backdoor, tracked as STOCKSTAY, that has been continually developed and deployed by the Russia-linked threat actor Turla (aka SUMMIT, Secret Blizzard, VENOMOUS BEAR, UAC-0194) since at least December 2022. Turla has deployed STOCKSTAY against government and military organizations in Ukraine, as well as entities with an interest in Italian foreign policy. Used for ongoing cyber espionage, this backdoor shares s…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Mandiant (Google) on cloud.google.com.
Mentioned in the excerpt
More from Mandiant (Google)32
- Investigating Ephemeral Supply Chain TamperingMandiant (Google) · Published 15 Oct
- ARMORY CASTLE Exploits BeyondTrustMandiant (Google) · Published 15 Oct
- Mandiant Cybersecurity ConsultingMandiant (Google) · Added 18 Oct
- Why Are You Texting Me? UNC3944 Leverages SMS Phishing Campaigns for SIM Swapping, Ransomware, Extortion, and NotorietyMandiant (Google) · Published 14 Sep 2023
On the same topics
- Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRatMalwarebytes · Published 5 Jan 2021
- Kazuar (Malware Family)Malpedia · Added 18 Oct
- Animal Farm APT and the Shadow of French IntelligenceInfosec Institute · Published 8 Jul 2015
- Darktrace Malware Analysis: Unpacking SnappyBeeDarktrace · Published 3 Feb
