Turla STOCKSTAY Delivery via Malicious RDP File Attachment

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•5

Detects the execution of the Windows Remote Desktop Client (mstsc.exe) spawned from an email client, browser, or archival application following the opening of a .rdp file attachment. This behavior is consistent with Turla's STOCKSTAY campaign, where malicious RDP configuration files are used to target sensitive entities.