Turla STOCKSTAY MSI/C2 Download from GitHub and render.com Staging

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

Detects network activity associated with the Turla group's STOCKSTAY malware infrastructure. This includes downloading MSI installers or server scripts from GitHub, as well as WebSocket C2 communications with the onrender.com platform.