New Turla Stockstay Backdoor Emerges

The Google Threat Intelligence Group has uncovered a .NET backdoor known as STOCKSTAY, which has been a persistent component of the espionage toolkit utilized by the highly active and capable Russia-linked threat actor Turla since at least December 2022. 

Known historically for its tight ties to Russia’s Federal Security Service (FSB) and its development of the Snake implant, Turla has leveraged STOCKSTAY to target sensitive government and military organizations, specifically within Ukraine and among entities focused on Italian foreign policy.

STOCKSTAY is defined by a multi-component, .NET-based architecture that utilizes the Windows Forms framework to maintain persistent intelligence gathering capabilities. The malware employs a modular design where distinct components communicate via an inter-process communication channel utilizing the WM_COPYDATA message protocol. Central to its operations is the STOCKSTAY.STOCKMARKET component, which serves as the primary orchestrator, managing command-and-control logic over secure WebSocket connections using the open-source websocket-sharp library. To ensure secure data exfiltration, this component generates a unique 4096-bit RSA key pair upon initial execution, allowing for the encryption of task responses before transmission to the C2 server.

The operational heart of the malware resides in the STOCKSTAY.STOCKTRADER component, internally referred to as “sys.” This backdoor component handles the actual execution of malicious tasks, supporting a wide range of filesystem, registry, and command execution operations on the infected host. STOCKTRADER is capable of conducting comprehensive reconnaissance, including the generation of directory listings and performing recursive enumerations of file paths, effectively allowing the operators to map the environment of the compromised target. 

This modular approach allows the threat actor to maintain a strict separation between C2 management and task execution, minimizing the footprint and exposure of any single module. The GTIG researchers were also able to uncover part of the operators’ control infrastructure.

“GTIG identified a publicly accessible GitHub repository containing a Python implementation of the victim-facing STOCKSTAY WebSocket server controller. The lightweight design of the server component appears to supplement the threat actor’s usage of third-party hosting platforms such as Render platform which provides a platform for hosting web services, including WebSockets,” the Google post says.

“The inability for the server to decrypt inbound messages prevents introspection by platform operators, and further obfuscates the location of the threat actor’s dedicated infrastructure. This architecture somewhat resembles Turla’s multi-hop KAZUAR C2 infrastructure.”

Throughout its operational lifecycle, STOCKSTAY has demonstrated a persistent focus on evasion through disguise. While early versions of the malware were explicitly styled as stock market data viewing utilities—a cover that extended to file naming conventions, implant configuration storage, and control messages—researchers have identified newer variants that adapt to masquerade as benign PDF viewers and calculator applications. This evolution is evidence of Turla's continued investment in the toolkit, which researchers have noted shares significant code and functional lineage with KAZUAR, another historically effective and successful toolkit attributed to the group.

Turla is a highly active APT that has been studied by researchers for many years. The group’s campaigns and operations stretch back to at least 2004 and possibly earlier and Turla actors are well-known for their extensive toolset and wide range of capabilities. 

The persistent deployment of STOCKSTAY underscores the intelligence-gathering priorities of Turla. By consistently integrating academic and diplomatic lure content into their infrastructure, the threat actor demonstrates a clear understanding of their high-value targets and a readiness to tailor their delivery mechanisms accordingly.