Turla STOCKSTAY CVE-2025-8088 RDP/HTA spearphish via email client or WinRAR path traversal

Ibrahim Saud@tektrix

•updated Jun 25, 2026•1•0•11

Detects a multi-stage attack chain beginning with the execution of suspicious processes (mstsc.exe, mshta.exe) from email clients or download directories, followed by WinRAR or unrar.exe writing files containing path traversal sequences, and concluding with the execution of a child process from a suspicious directory. This behavior aligns with exploitation attempts targeting vulnerabilities like CVE-2025-8088.