Turla's STOCKSTAY Backdoor — Google Exposes Russian FSB-Aligned APT's .NET Espionage Implant Targeting Ukrainian Military

Google Threat Intelligence Group attributes STOCKSTAY, a multi-component .NET backdoor, to Turla (FSB Center 16) with high confidence, and its build history reaches back to at least December 2022 with operations against Ukrainian targets still running into 2026. STOCKBROKER tunnels operator traffic over proxy-aware WebSockets built on websocket-sharp, STOCKMARKET orchestrates the chain with an encrypted on-disk config disguised as cryptocurrency market data, and STOCKTRADER delivers file operations, registry manipulation, command execution, screen capture, and WMI-based host survey, with all three components talking over WM_COPYDATA and every infection carrying its own 4096-bit RSA key pair for C2. The documented arc runs from September 2023 samples in Germany through a January 2024 Mandiant response in Ukraine where STOCKSTAY landed alongside KAZUAR on a compromised domain controller, an MSI campaign against Italian foreign policy entities in February 2024, and drone-themed phishing armed with the WinRAR flaw CVE-2025-8088 against Ukrainian targets in November 2025.

This is a standing espionage platform, not a campaign that ends with a news cycle: four years of sustained development aimed at a fixed victim set of Ukrainian military and adjacent government and foreign policy entities. Exposure reduces to any Windows host in those networks where a user opens mail or a browser, because delivery ran through malicious RDP files, compromised Ukrainian government WordPress sites, and phishing from compromised academic accounts, none of which need privilege or a server-side foothold. One property the reporting carries but does not draw out: STOCKSTAY configs are environmentally keyed, decrypting only with the target hostname or domain hash, so a sample detonated in a generic sandbox yields no config, no C2 traffic, and an inert-looking file. Analysts triaging quarantined samples off-target will under-score real detections, and any victim count built from detonations is a floor, not a census. GTIG's moderate-confidence link between STOCKSTAY and KAZUAR developers, backed by the shared K1MORPHER obfuscator built on the Squirrel3 PRNG and by matching environmental keying, argues for hunting both families under one hypothesis rather than two.

Hunt the network first: WebSocket sessions from .NET processes to Render, Glitch, or Heroku endpoints under a /ws path, and specifically the four observed C2 endpoints wss://wool-basalt-clock.glitch.me/ws, wss://weatherdataai.theworkpc.com/ws, wss://canal1zac1a.onrender.com/ws, and wss://driverx86-adobe.onrender.com/ws. Block those hostnames and sweep historical proxy and DNS logs for prior connections, since free-tier hosting hides in ordinary egress allowlists. On the endpoint, look for Run keys pointing at %LOCALAPPDATA%\Programs\SMN\ and scheduled tasks named GoogleUpdaterTask* that masquerade as Google update machinery, and flag user-mode .NET binaries writing to that install path. Patch WinRAR to 7.13 or later for CVE-2025-8088 wherever archive handling happens, and tune mail controls against RDP file attachments and trusted-looking government WordPress links as delivery surfaces.

Two developments would move this assessment. GTIG raising the KAZUAR developer-overlap judgment from moderate to high confidence would merge two hunting programs into one and widen the exposure picture beyond Ukraine. STOCKSTAY C2 rotating off Render, Glitch, and Heroku onto dedicated infrastructure would invalidate the current network signatures and shift the detection weight onto the SMN persistence path and the environmental-keying behavior.