Turla's STOCKSTAY: A Fresh .NET Backdoor Aimed at Kyiv and Rome
Google's threat hunters tie the Russian FSB-linked crew to a previously undocumented Windows implant hitting Ukrainian military targets and Italy-focused diplomatic entities.
Turla has a new toy.
The Russian state-sponsored group — tracked variously as Snake, Venomous Bear, and UNC4210 — has been deploying a previously undocumented .NET backdoor dubbed STOCKSTAY against Ukrainian government and military targets, along with organizations involved in Italian foreign policy.
The attribution comes from Google Threat Intelligence Group, which describes STOCKSTAY as actively maintained rather than a one-off. Translation: expect variants. The implant joins an already crowded Turla toolkit that includes Kazuar, Pelmeni, and the older Snake rootkit family (the latter taken down in Operation MEDUSA back in 2023, though clearly the operators didn't take the hint).
The targeting pattern is the interesting part. Ukrainian military and government victims fit Turla's longstanding intelligence-collection remit. The Italian foreign-policy angle is a reminder that the group's collection mandate runs well beyond the immediate war zone, into NATO member-state diplomatic apparatus and the analysts who advise them.
Few technical specifics on STOCKSTAY are public at time of writing. What's known: it's a Windows backdoor written in .NET, deployed as part of broader intrusion sets rather than as an initial-access tool. That's consistent with Turla tradecraft — the group typically gets in via spearphishing, hijacked infrastructure, or piggybacking on other actors' implants (they've been caught reusing Andromeda victims before), then drops bespoke backdoors for long-haul collection.
For defenders, the operational guidance is unchanged but worth restating.
Hunt for unusual .NET assemblies executing from user-writable paths. Turla has a long history of living-off-the-land techniques and abusing legitimate cloud services for C2, so flat egress allow-lists won't catch this. Pay attention to PowerShell and WMI activity on hosts belonging to staff with diplomatic, defense, or Ukraine-policy portfolios.
If you're a CERT-EU constituent or an Italian MFA contractor, you are explicitly in scope. Treat it that way.
The broader pattern here is one defenders have been tracking for a decade-plus: Turla iterates faster than any single backdoor's IoCs stay useful. By the time STOCKSTAY hashes circulate on VirusTotal, the next variant is probably already in the wild. Indicator-based detection is necessary but not sufficient — behavioral hunting on .NET loaders, scheduled-task persistence, and anomalous outbound TLS to legitimate SaaS endpoints is where the value is.
No CVEs are attached to this campaign; STOCKSTAY is a post-compromise tool, not an exploit. Initial access vectors for the current intrusion set have not been publicly detailed.
The Google writeup is the primary source for IoCs and YARA. Pull it, push the hashes to your EDR, and check telemetry going back at least 12 months. Turla plays a long game.
