Turla STOCKSTAY WebSocket C2 to weatherdataai.theworkpc.com

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•0

Detects network traffic associated with the Turla group's STOCKSTAY malware, specifically identifying outbound WebSocket upgrade requests directed to the known command-and-control domain weatherdataai.theworkpc.com.