Turla STOCKSTAY Environmental Keying via Hostname-Based Config Decryption

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•3

Detects STOCKSTAY .NET backdoor components (e.g., STOCKMARKET, STOCKTRADER) accessing their encrypted 'fonts' configuration files located in the local application data SMN directory. These components use environmental keying (hostname or domain-based) to decrypt the configuration, a technique designed to thwart analysis.