Executive Summary
Google Threat Intelligence Group (GTIG) has identified a new .NET backdoor ecosystem named STOCKSTAY, attributed to the Russian FSB-linked threat actor Turla (aka Secret Blizzard, Venomous Bear). Since late 2022, this toolkit has evolved into a sophisticated multi-component architecture targeting military and diplomatic organizations, particularly in Ukraine and Italy. The malware shares significant code overlaps with Turla's established KAZUAR toolkit, including a specialized string obfuscation mechanism tracked as K1MORPHER.
STOCKSTAY employs a modular design consisting of a tunneler (STOCKBROKER), an orchestrator (STOCKMARKET), and a backdoor (STOCKTRADER). The actor utilizes a variety of delivery methods, ranging from malicious RDP configuration files and HTA lures to the exploitation of WinRAR path traversal vulnerability CVE-2025-8088. Its infrastructure frequently leverages third-party platforms like Render and GitHub to host C2 controllers and installers, complicating attribution and remediation efforts.
The deployment of STOCKSTAY alongside KAZUAR suggests it may serve as a fail-safe persistent access mechanism. The group's consistent focus on diplomatic and defense targets, combined with their use of environmental keying to prevent analysis, underscores a high level of operational security and intent for long-term cyber espionage.