Turla STOCKSTAY RDP Phishing Lure Leading to RDP Connection on Port 3389

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•3

Detects a suspicious sequence of events where a user initiates an outbound RDP connection using mstsc.exe on port 3389, followed shortly by the execution of a file named MicrosoftUpdateOneDrive.exe. This behavior is indicative of the Turla threat group deploying their STOCKSTAY.MARKETMAKER malware via an RDP-based phishing lure.