Google Details Turla's New STOCKSTAY Backdoor Used in Ukraine Espionage Attacks

Google's Threat Intelligence Group has identified a new .NET backdoor called STOCKSTAY, attributed to the Russian state-sponsored threat actor Turla. This backdoor has been used in espionage attacks against government and military organizations in Ukraine. Additionally, entities with an interest in Italian foreign policy have also been targeted with STOCKSTAY. The backdoor is described as being continually developed by Turla. STOCKSTAY has been deployed against specific organizations in Ukraine and those related to Italian foreign policy interests. The backdoor affects Windows systems.