Turla STOCKSTAY COM DLL Surrogate IPC - DllHost Spawned by STOCKSTAY Component

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

Detects the spawning of DllHost.exe (a Windows COM surrogate process) by identified STOCKSTAY malware components or via suspicious msiexec installations targeting STOCKSTAY directories. This behavior is indicative of inter-process communication (IPC) used by Turla's STOCKSTAY malware suite.