Turla’s Advanced Espionage Operations in Ukraine Uncovered

Turla, a notorious threat group linked to Russian intelligence, has enhanced its cyber arsenal with the introduction of a new malware called STOCKSTAY. This sophisticated backdoor has been actively deployed against Ukrainian governmental and military entities since at least December 2022.

STOCKSTAY: A Sophisticated Malware Tool

Developed in .NET, STOCKSTAY utilizes secure WebSocket connections to communicate discreetly with its operators, remaining undetectable in typical network traffic. This indicates a highly organized, state-sponsored cyber-espionage campaign. Initially, STOCKSTAY masqueraded as a stock market data tool, using deceptive file names to avoid detection.

By 2025, the malware evolved, appearing as PDF viewers and calculator utilities, demonstrating Turla’s adaptability. The threat group has consistently targeted Western foreign affairs departments, defense organizations, and Ukraine’s military, aligning its operations with Russian national interests.

Unveiling Turla’s Infrastructure and Tactics

The Google Threat Intelligence Group (GTIG) has meticulously documented STOCKSTAY, highlighting its components and connection with another Turla tool, KAZUAR. Turla, also known as SUMMIT and VENOMOUS BEAR, has been linked to Russia’s Federal Security Service since 2004.

Turla has used compromised infrastructure in Ukraine, including government services and IT servers, to deploy its payloads. This strategy enables the threat actors to blend in with local network traffic and evade detection. A phishing wave in November 2025 targeted Ukrainian individuals, exploiting a WinRAR vulnerability (CVE-2025-8088), prompting Google to alert affected users.

Adapting and Escalating Threats

One of Turla’s most calculated strategies involves using local Ukrainian infrastructure to distribute malware, bypassing foreign detection controls. Initial access was gained via phishing emails with malicious RDP files. In early 2025, targets received emails from a fake defense academy, leading to actor-controlled infrastructure.

STOCKSTAY consists of three main components: STOCKMARKET, STOCKBROKER, and STOCKTRADER, each handling different aspects of the malicious operations. Notably, the malware operates during business hours to minimize detection risks.

Future Implications and Security Measures

STOCKSTAY’s close resemblance to KAZUAR highlights a potential shared development team, as both tools exhibit multi-component architectures and obfuscation techniques. In April 2025, STOCKSTAY adopted a new string obfuscation method, reinforcing its sophistication.

Turla’s ongoing enhancements to STOCKSTAY’s capabilities confirm its status as a leading espionage threat. Organizations are urged to review their cybersecurity measures against the listed indicators of compromise to mitigate potential risks.