Turla STOCKSTAY .NET Backdoor Targeting Ukraine Government and Military via CVE-2025-8088

Turla STOCKSTAY .NET Backdoor Targeting Ukraine Government (TL-2026-0966), also tracked as STOCKSTAY, is a high-severity malware campaign scored CVSS 8.8, first published 2026-06-28 and last reviewed 2026-07-06. It is attributed to Turla (Russia) with high confidence, affects RARLAB WinRAR, references 1 CVE (CVE-2025-8088), maps to 40 MITRE ATT&CK techniques (T1005, T1008, T1012), and is covered by 9 detection rules and 36 indicators of compromise.

Key facts for TL-2026-0966

Threat ID
TL-2026-0966
Also known as
STOCKSTAY, Operation STOCKSTAY
Severity
HIGH
CVSS
8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
MALWARE
First published
2026-06-28
Last reviewed
2026-07-06
Attribution
Turla
Attribution confidence
HIGH
Nation-state nexus
Russia
Motivation
ESPIONAGE
Target sectors
government administration, military, defense, foreign-policy, diplomatic
Target regions
ukraine, Europe, italy, netherlands, poland, germany
Detection rules
9
Indicators of compromise
36
Updates
2026-07-06 · revalidated 1× · latest source

Malware and tooling in Turla STOCKSTAY .NET Backdoor Targeting Ukraine Government

Malware and tooling: Kazuar - S0265, STOCKSTAY, STOCKSTAY.MARKETMAKER, STOCKSTAY.STOCKBROKER, STOCKSTAY.STOCKMARKET, STOCKSTAY.STOCKTRADER, K1MORPHER, PteroGraphin, PteroOdd, websocket-sharp

Russian state-sponsored Turla (FSB) deployed a previously undocumented modular .NET backdoor family called STOCKSTAY against Ukrainian government, military, and Italian foreign-policy-linked targets. STOCKSTAY consists of four role-separated components — MARKETMAKER (downloader), STOCKBROKER (tunneler), STOCKTRADER (backdoor), STOCKMARKET (orchestrator) — communicating via WM_COPYDATA IPC and exfiltrating data over encrypted WebSocket C2. Delivery exploited malicious RDP file attachments and RAR archives weaponizing CVE-2025-8088, a critical WinRAR path-traversal/ADS-abuse flaw rated CVSS 8.8 that enables payload persistence via the Windows Startup folder.

How Turla STOCKSTAY .NET Backdoor Targeting Ukraine Government works

Google Threat Intelligence Group (GTIG) publicly detailed STOCKSTAY on June 26, 2026, attributing it with high confidence to Turla, a Russian FSB-linked advanced persistent threat group active since at least 2004. STOCKSTAY development is assessed to have begun in December 2022; the earliest sample uploaded to VirusTotal appeared in December 2023, originating from the Netherlands.

STOCKSTAY is a modular four-component .NET backdoor that was originally designed to masquerade as a stock market data viewing tool before being adapted to impersonate PDF viewers and calculator utilities. The components communicate with each other via Windows inter-process communication (IPC) using WM_COPYDATA messages, and communicate externally with C2 infrastructure via the open-source websocket-sharp library over encrypted WebSocket connections. The modular separation mirrors the role-separated architecture of Turla's long-running Kazuar implant (Kernel / Bridge / Worker), and GTIG identified concrete code-level overlaps including: (1) shared .NET development, (2) identical use of compromised WordPress sites as payload delivery and C2-relay infrastructure, and (3) the K1MORPHER string obfuscation technique introduced into both STOCKSTAY and Kazuar within a similar development window.

STOCKSTAY.MARKETMAKER is the downloader/installer: it sets up and executes the three remaining modules, establishes Windows registry persistence for autostart, and runs silently with no user interface. STOCKSTAY.STOCKBROKER is a proxy-aware tunneler that establishes the secure WebSocket connection to the C2 server and provides encrypted network communications to the suite. STOCKSTAY.STOCKMARKET is the orchestrator: it parses the backdoor configuration (WebSocket server endpoint, time interval, blackout days) and coordinates between STOCKBROKER and STOCKTRADER. STOCKSTAY.STOCKTRADER is the main payload ('sys' internally), handling command execution including file enumeration (Dir), file exfiltration by extension (Get), file upload (Put), process execution (Run), registry read/write/delete (RegRead/RegWrite/RegDelete), directory creation and deletion (MkDir/RmDir), screen capture (Image), ZIP extraction (UnpackArchive), system information gathering (Sysinfo), and multi-task chaining (MultyTask).

Google identified a publicly accessible GitHub repository (ChikenFresh/google-ai-labs-it) containing a Python implementation of the victim-facing STOCKSTAY WebSocket server controller, which handles inbound messages from compromised clients and logs their IP addresses. The actor-side C2 decryption key is not held by this relay, preventing introspection by platform operators — a deliberate architecture that obscures dedicated actor infrastructure, analogous to Turla's multi-hop Kazuar C2 relay chain.

Delivery followed two primary vectors: (1) in early 2025, phishing emails with malicious RDP file attachments connecting victims to actor infrastructure for payload staging; (2) in November 2025, a phishing wave targeting Ukrainian organizations using RAR archives weaponizing CVE-2025-8088 — a path traversal/Alternate Data Streams (ADS) abuse vulnerability in WinRAR ≤7.12 discovered by ESET (Anton Cherepanov, Peter Košinár, Peter Strýček). CVE-2025-8088, rated CVSS 8.8 HIGH, allows a crafted malicious RAR archive to write an arbitrary executable into the Windows Startup folder via ADS entries while displaying a decoy document, achieving persistence without requiring elevated privileges. Exploitation in the wild began approximately July 18, 2025; RARLAB released patch WinRAR 7.13 on July 30, 2025; CISA added CVE-2025-8088 to the KEV catalog on August 12, 2025 with a remediation deadline of September 2, 2025. Multiple other Russian-linked threat actors — APT44 (Sandworm), Gamaredon, and RomCom — also exploited CVE-2025-8088 concurrently.

GTIG observed STOCKSTAY deployed at two operational stages: (1) as initial access tooling into unprofiled environments, and (2) as post-exploitation tooling after actor reconnaissance of specific high-value hosts, implying host-specific configuration and prior access. Critically, GTIG observed STOCKSTAY deployed within Ukrainian networks at the end of operations that had previously relied heavily on Kazuar — consistent with GTIG's low-confidence assessment that the actor is testing new capabilities in live operations, potentially anticipating access remediation. This aligns with SentinelOne's LABScon25 reporting (September 2025) that Gamaredon (using PteroGraphin and PteroOdd tooling) actively collaborated with Turla between February and June 2025 to restore Turla's access in Ukrainian networks after Turla foothold loss.

Targeting scope: primary focus is Ukrainian government and military; secondary targeting covers entities linked to Italian foreign policy, with earlier campaign activity observed in Netherlands, Poland, and Germany. Phishing lures employ academic or diplomatic themes.

MITRE ATT&CK techniques used in TL-2026-0966

Collection

T1005 Data from Local System; T1113 Screen Capture; T1560 Archive Collected Data

Command and Control

T1008 Fallback Channels; T1071 Application Layer Protocol; T1090 Proxy; T1102 Web Service; T1105 Ingress Tool Transfer; T1573 Encrypted Channel

Discovery

T1012 Query Registry; T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery

Exfiltration

T1020 Automated Exfiltration; T1041 Exfiltration Over C2 Channel

Lateral Movement

T1021 Remote Services

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1497 Virtualization/Sandbox Evasion; T1564 Hide Artifacts

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution; T1569 System Services

defense-impairment

T1112 Modify Registry

Initial Access

T1190 Exploit Public-Facing Application; T1566 Phishing

Persistence

T1547 Boot or Logon Autostart Execution

Resource Development

T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1585 Establish Accounts; T1586 Compromise Accounts; T1587 Develop Capabilities; T1608 Stage Capabilities

Reconnaissance

T1591 Gather Victim Org Information; T1592 Gather Victim Host Information

Affected products and versions in Turla STOCKSTAY .NET Backdoor Targeting Ukraine Government

  • RARLAB — WinRAR
    Vulnerable versions: <=7.12
    Fixed in: 7.13
  • Microsoft — Windows
    Vulnerable versions: Windows 10; Windows 11; Windows Server 2016; Windows Server 2019; Windows Server 2022
  • dtSearch Corp — dtSearch
    Vulnerable versions: <2023.01
    Fixed in: 2023.01

Remediation for Turla STOCKSTAY .NET Backdoor Targeting Ukraine Government

Patches

  • WinRAR 7.13 (RARLAB, released July 30, 2025) — remediates CVE-2025-8088 ADS path traversal

Immediate actions

  • Update WinRAR to version 7.13 or later immediately (CVE-2025-8088 patch)
  • Block execution of .hta files via mshta.exe via AppLocker/WDAC policy
  • Block RDP file (*.rdp) email attachments at mail gateway
  • Inspect Windows Startup folders for unauthorized executables placed via ADS
  • Hunt for websocket-sharp library (websocket-sharp.dll) on enterprise endpoints
  • Block or monitor GitHub domain github.com/ChikenFresh/ at proxy/DNS level
  • Search for WM_COPYDATA IPC usage between unsigned processes
  • Audit Windows registry Run keys for .NET executables added since November 2025

Workarounds

  • Disable WinRAR or restrict to sandboxed environments until patch applied
  • Block extraction of Alternate Data Streams from archive utilities via Group Policy
  • Configure Windows to disallow writing to Startup folders by non-elevated processes

Longer-term hardening

  • Deploy EDR with behavioral detection for WM_COPYDATA IPC between unsigned .NET processes
  • Implement DKIM/DMARC/SPF and advanced email filtering to block RDP and RAR lures
  • Block outbound WebSocket connections to non-approved endpoints at perimeter
  • Implement application allowlisting (WDAC/AppLocker) to prevent unsigned .NET binary execution
  • Leverage threat intelligence feeds to block Turla/STOCKSTAY infrastructure IOCs proactively
  • Conduct Purple Team exercises against STOCKSTAY TTPs using available ATT&CK mappings
  • Monitor compromised WordPress sites as potential STOCKSTAY payload delivery and C2 relay nodes

CVEs associated with Turla STOCKSTAY .NET Backdoor Targeting Ukraine Government

CVE-2025-8088

Weaknesses (CWE) in Turla STOCKSTAY .NET Backdoor Targeting Ukraine Government

CWE-35, CWE-434, CWE-73

Timeline of Turla STOCKSTAY .NET Backdoor Targeting Ukraine Government

  • Google GTIG assesses STOCKSTAY development began in December 2022, based on code analysis and artifact dating.
  • Earliest known STOCKSTAY sample with role-separated component architecture uploaded to VirusTotal; origin traced to Netherlands.
  • Gamaredon and Turla begin active operational collaboration (February–June 2025): Gamaredon's PteroGraphin and PteroOdd tools used to deploy Turla's Kazuar backdoor and restore Turla footholds in Ukrainian networks after access loss.
  • Early 2025 STOCKSTAY phishing campaign: malicious RDP file attachments sent to targets; victims connecting to actor infrastructure receive STOCKSTAY payload including MARKETMAKER downloader.
  • GTIG observes STOCKSTAY updated to include the K1MORPHER string/data obfuscation module, built on the Squirrel3 pseudo-random number generation algorithm first presented at GDC 2017.
  • A compromised Ukrainian university email account is used to send a phishing email themed around a fake distance-learning platform, containing a malicious RDP configuration file connecting the victim to actor-controlled infrastructure for STOCKSTAY.MARKETMAKER delivery.
  • Two STOCKSTAY.STOCKBROKER samples are uploaded to VirusTotal from Poland, extending the geographic signal for the campaign's operational reach beyond the Netherlands.
  • GTIG observes K1MORPHER obfuscation code appearing in KAZUAR samples, strengthening the assessed code-development link between STOCKSTAY and KAZUAR ecosystems.
  • CVE-2025-8088 (WinRAR path traversal/ADS abuse, CVSS 8.8) begins active exploitation in the wild by multiple threat actors including Turla, APT44 (Sandworm), Gamaredon, and RomCom.
  • A suspected Turla-operated GitHub account, Roberto1983-ai, is created; the following day it uploads the malicious installer DiplomacyEduAI.msi to repository msi_installer_test2.
  • The Roberto1983-ai GitHub account uploads DiplomacyEduAI.msi — a malicious MSI installer masquerading as diplomatic-education software — to a public repository for suspected STOCKSTAY staging or operational testing.
  • RARLAB releases WinRAR 7.13 patching CVE-2025-8088 path traversal/Alternate Data Streams vulnerability that allows arbitrary write to Windows Startup folder.
  • CISA adds CVE-2025-8088 to the Known Exploited Vulnerabilities catalog; federal agencies required to remediate by September 2, 2025.
  • November 2025 phishing wave targeting Ukrainian government and military organizations: RAR archives weaponizing CVE-2025-8088 deliver STOCKSTAY.MARKETMAKER, using academic and diplomatic lure themes.
  • GTIG observes STOCKSTAY deployed at the end of Ukrainian network operations that previously relied on Kazuar, indicating operational testing of new tooling ahead of anticipated access remediation.
  • Turla's Kazuar backdoor reported to have evolved into a modular P2P botnet for persistent access, providing parallel context for STOCKSTAY's parallel development trajectory.
  • Google Threat Intelligence Group publicly discloses STOCKSTAY campaign details, component analysis, C2 architecture, and Kazuar code overlaps, exposing the ChikenFresh/google-ai-labs-it GitHub C2 relay.

Update history for TL-2026-0966

Sources cited for Turla STOCKSTAY .NET Backdoor Targeting Ukraine Government

Threats related to Turla STOCKSTAY .NET Backdoor Targeting Ukraine Government

Detection coverage for TL-2026-0966

As of 2026-07-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0966 across Splunk SPL, Microsoft KQL and Sigma, covering 36 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats