New Turla Stockstay Backdoor Emerges
Known historically for its tight ties to Russia’s FSB and its development of the Snake implant, Turla has leveraged STOCKSTAY to target sensitive government and military organizations.
All topics
Known historically for its tight ties to Russia’s FSB and its development of the Snake implant, Turla has leveraged STOCKSTAY to target sensitive government and military organizations.
The campaign is not the result of a compromise of Fortinet itself, but rather involves the attackers testing a custom list of known passwords for Fortinet devices.
The vulnerability is a critical one and Check Point Research said that it’s likely that the actor targeting the bug is a financially motivated group.
The company said it is still working through the intrusion but does not believe any customer repositories or data was affected at this point.
As of May 2026, over 6,502 ATG services running on 6,057 unique hosts were found to be reachable on the public internet across more than 65 countries.
Researchers have linked the compromise to the "Mini Shai-Hulud" campaign, which has been ongoing for several weeks and is associated with TeamPCP.