Turla STOCKSTAY STOCKTRADER Screenshot Capture via ConverterDDSNet or SMEditor

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

Detects the execution of known Turla STOCKSTAY/STOCKTRADER backdoor components (ConverterDDSNet.exe or SMEditor.exe) which are used to perform unauthorized screen capture and data exfiltration from the victim's host.