Turla STOCKSTAY docs.zip payload download from drs.gov.ua

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•5

Detects HTTP GET requests to a specific file path (docs.zip) on the Ukrainian government website (drs.gov.ua), identified as an activity associated with the Turla threat group's STOCKSTAY malware component.