Turla STOCKSTAY WebSocket C2 to canal1zac1a.onrender.com

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•0

This rule detects network traffic patterns associated with the Turla group's STOCKSTAY malware, specifically identifying WebSocket upgrade requests directed at the external domain 'canal1zac1a.onrender.com'. This pattern is indicative of a Command and Control (C2) channel initiation.