# Turla STOCKSTAY .NET Backdoor Targeting Ukraine Government and Military via CVE-2025-8088

> Russian state-sponsored Turla (FSB) deployed a previously undocumented modular .NET backdoor family called STOCKSTAY against Ukrainian government, military, and Italian foreign-policy-linked targets. STOCKSTAY consists of four role-separated components — MARKETMAKER (downloader), STOCKBROKER (tunneler), STOCKTRADER (backdoor), STOCKMARKET (orchestrator) — communicating via WM_COPYDATA IPC and exfiltrating data over encrypted WebSocket C2. Delivery exploited malicious RDP file attachments and RAR archives weaponizing CVE-2025-8088, a critical WinRAR path-traversal/ADS-abuse flaw rated CVSS 8.8 that enables payload persistence via the Windows Startup folder.

- **Published:** 2026-06-28T00:00:00Z
- **Last reviewed:** 2026-07-06T19:34:18.064Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0966
- **ID:** TL-2026-0966
- **Severity:** HIGH (CVSS 8.8)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Turla (Russia)
- **Detections:** 9 · **IOCs:** 36 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-8088

## Description

Google Threat Intelligence Group (GTIG) publicly detailed STOCKSTAY on June 26, 2026, attributing it with high confidence to Turla, a Russian FSB-linked advanced persistent threat group active since at least 2004. STOCKSTAY development is assessed to have begun in December 2022; the earliest sample uploaded to VirusTotal appeared in December 2023, originating from the Netherlands.

STOCKSTAY is a modular four-component .NET backdoor that was originally designed to masquerade as a stock market data viewing tool before being adapted to impersonate PDF viewers and calculator utilities. The components communicate with each other via Windows inter-process communication (IPC) using WM_COPYDATA messages, and communicate externally with C2 infrastructure via the open-source websocket-sharp library over encrypted WebSocket connections. The modular separation mirrors the role-separated architecture of Turla's long-running Kazuar implant (Kernel / Bridge / Worker), and GTIG identified concrete code-level overlaps including: (1) shared .NET development, (2) identical use of compromised WordPress sites as payload delivery and C2-relay infrastructure, and (3) the K1MORPHER string obfuscation technique introduced into both STOCKSTAY and Kazuar within a similar development window.

STOCKSTAY.MARKETMAKER is the downloader/installer: it sets up and executes the three remaining modules, establishes Windows registry persistence for autostart, and runs silently with no user interface. STOCKSTAY.STOCKBROKER is a proxy-aware tunneler that establishes the secure WebSocket connection to the C2 server and provides encrypted network communications to the suite. STOCKSTAY.STOCKMARKET is the orchestrator: it parses the backdoor configuration (WebSocket server endpoint, time interval, blackout days) and coordinates between STOCKBROKER and STOCKTRADER. STOCKSTAY.STOCKTRADER is the main payload ('sys' internally), handling command execution including file enumeration (Dir), file exfiltration by extension (Get), file upload (Put), process execution (Run), registry read/write/delete (RegRead/RegWrite/RegDelete), directory creation and deletion (MkDir/RmDir), screen capture (Image), ZIP extraction (UnpackArchive), system information gathering (Sysinfo), and multi-task chaining (MultyTask).

Google identified a publicly accessible GitHub repository (ChikenFresh/google-ai-labs-it) containing a Python implementation of the victim-facing STOCKSTAY WebSocket server controller, which handles inbound messages from compromised clients and logs their IP addresses. The actor-side C2 decryption key is not held by this relay, preventing introspection by platform operators — a deliberate architecture that obscures dedicated actor infrastructure, analogous to Turla's multi-hop Kazuar C2 relay chain.

Delivery followed two primary vectors: (1) in early 2025, phishing emails with malicious RDP file attachments connecting victims to actor infrastructure for payload staging; (2) in November 2025, a phishing wave targeting Ukrainian organizations using RAR archives weaponizing CVE-2025-8088 — a path traversal/Alternate Data Streams (ADS) abuse vulnerability in WinRAR ≤7.12 discovered by ESET (Anton Cherepanov, Peter Košinár, Peter Strýček). CVE-2025-8088, rated CVSS 8.8 HIGH, allows a crafted malicious RAR archive to write an arbitrary executable into the Windows Startup folder via ADS entries while displaying a decoy document, achieving persistence without requiring elevated privileges. Exploitation in the wild began approximately July 18, 2025; RARLAB released patch WinRAR 7.13 on July 30, 2025; CISA added CVE-2025-8088 to the KEV catalog on August 12, 2025 with a remediation deadline of September 2, 2025. Multiple other Russian-linked threat actors — APT44 (Sandworm), Gamaredon, and RomCom — also exploited CVE-2025-8088 concurrently.

GTIG observed STOCKSTAY deployed at two operational stages: (1) as initial access tooling into unprofiled environments, and (2) as post-exploitation tooling after actor reconnaissance of specific high-value hosts, implying host-specific configuration and prior access. Critically, GTIG observed STOCKSTAY deployed within Ukrainian networks at the end of operations that had previously relied heavily on Kazuar — consistent with GTIG's low-confidence assessment that the actor is testing new capabilities in live operations, potentially anticipating access remediation. This aligns with SentinelOne's LABScon25 reporting (September 2025) that Gamaredon (using PteroGraphin and PteroOdd tooling) actively collaborated with Turla between February and June 2025 to restore Turla's access in Ukrainian networks after Turla foothold loss.

Targeting scope: primary focus is Ukrainian government and military; secondary targeting covers entities linked to Italian foreign policy, with earlier campaign activity observed in Netherlands, Poland, and Germany. Phishing lures employ academic or diplomatic themes.

## MITRE ATT&CK

- T1591 Gather Victim Org Information
- T1592 Gather Victim Host Information
- T1584 Compromise Infrastructure
- T1585 Establish Accounts
- T1608 Stage Capabilities
- T1566 Phishing
- T1190 Exploit Public-Facing Application
- T1204 User Execution
- T1569 System Services
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1564 Hide Artifacts
- T1140 Deobfuscate/Decode Files or Information
- T1112 Modify Registry
- T1070 Indicator Removal
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1012 Query Registry
- T1057 Process Discovery
- T1016 System Network Configuration Discovery
- T1021 Remote Services
- T1113 Screen Capture
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1090 Proxy
- T1105 Ingress Tool Transfer
- T1008 Fallback Channels
- T1041 Exfiltration Over C2 Channel
- T1020 Automated Exfiltration
- T1218 System Binary Proxy Execution
- T1497 Virtualization/Sandbox Evasion
- T1033 System Owner/User Discovery
- T1102 Web Service
- T1583 Acquire Infrastructure
- T1586 Compromise Accounts
- T1587 Develop Capabilities

## Sources

- [Google Details Turla's New STOCKSTAY Backdoor Used in Ukraine Espionage Attacks](https://thehackernews.com/2026/06/google-details-turlas-new-stockstay.html)
- [The Latest Addition to Turla's Intelligence Gathering Apparatus (GTIG)](https://cloud.google.com/blog/topics/threat-intelligence/stockstay-turla-intelligence-gathering)
- [CVE-2025-8088 Detail — NVD](https://nvd.nist.gov/vuln/detail/cve-2025-8088)
- [CISA Known Exploited Vulnerabilities — CVE-2025-8088](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Update WinRAR tools now: RomCom and others exploiting zero-day CVE-2025-8088 — ESET WeLiveSecurity](https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/)
- [Diverse Threat Actors Exploiting Critical WinRAR Vulnerability CVE-2025-8088 — Google Cloud Blog](https://cloud.google.com/blog/topics/threat-intelligence/exploiting-critical-winrar-vulnerability)
- [Turla group deploys new STOCKSTAY backdoor against Ukraine and Italy — SC Media](https://www.scworld.com/brief/turla-group-deploys-new-stockstay-backdoor-against-ukraine-and-italy)
- [Turla group adds more malware to Russia's espionage efforts against Ukraine — The Record](https://therecord.media/russia-turla-espionage-ukraine-stockstay-malware)
- [LABScon25: Gamaredon x Turla — Unveiling a 2025 Espionage Alliance Targeting Ukraine — SentinelOne](https://www.sentinelone.com/labs/labscon25-replay-gamaredon-x-turla-unveiling-a-2025-espionage-alliance-targeting-ukraine/)
- [Russian Hackers Gamaredon and Turla Collaborate to Deploy Kazuar Backdoor in Ukraine — The Hacker News](https://thehackernews.com/2025/09/russian-hackers-gamaredon-and-turla.html)
- [Turla Turns Kazuar Backdoor Into Modular P2P Botnet for Persistent Access — The Hacker News](https://thehackernews.com/2026/05/turla-turns-kazuar-backdoor-into.html)
- [CVE-2025-8088 WinRAR Flaw Abused for Startup Persistence — SOC Prime](https://socprime.com/active-threats/cve-2025-8088-critical-winrar-vulnerability/)
- [WinRAR CVE-2025-8088 Directory Traversal / ADS Vulnerability Explained — ThreatLocker](https://www.threatlocker.com/blog/winrar-cve-2025-8088-explained-directory-traversal-vulnerability-enables-arbitrary-file-writes)
- [Eliminate WinRAR CVE-2025-8088 with TruRisk Eliminate — Qualys](https://blog.qualys.com/product-tech/2025/09/05/cve-2025-8088-winrar-exploit-from-zero-day-to-zero-risk-with-trurisk-eliminate)
- [CVE-2025-8088 WinRAR Zero-Day in Social Engineering Attacks — Greenbone](https://www.greenbone.net/en/blog/new-winrar-flaw-cve-2025-8088-exploited-in-social-engineering-attacks/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0966