Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets

The Russian state-sponsored hacking group Turla, linked to Russia's Federal Security Service, has been deploying a new backdoor called StockStay against Ukrainian government and military targets since 2022. The espionage tool, which masquerades as legitimate software like PDF viewers or calculators, supports extensive capabilities including file exfiltration, screen capture, and system information harvesting. Recent attacks have used phishing emails and malicious RDP configuration files, with one November campaign exploiting a WinRAR vulnerability to compromise twenty Ukraine-based targets.