STOCKSTAY Another Day: The Latest Addition to Turla’s Intelligence Gathering Apparatus

Reported 25 Jun 2026 by otx · Severity: medium

Google Threat Intelligence Group has identified STOCKSTAY, a .NET backdoor continuously developed and deployed by Russia-linked Turla (FSB Center 16) since December 2022. The multi-component malware communicates via secure WebSocket connections and targets government and military