Experts from the Google Threat Intelligence Group have identified a new sophisticated spy tool — the STOCKSTAY backdoor, developed by the Russian hacking group Turla. The malware is actively used to attack military and government institutions in Ukraine, as well as diplomatic bodies in Europe.

Information about the threat was published in a recent Google report, cited by RBC-Ukraine. Specialists described the architecture and methods of operation of the new tool, which is a multi-component system written on the .NET platform using the Windows Forms framework.

Architecture and Functionality of STOCKSTAY

The STOCKSTAY system is characterized by a high degree of modularity. To communicate with the command server (C2), attackers use a secure WebSocket connection via the websocket-sharp library. Interaction between internal modules occurs through a special inter-process communication (IPC) channel using WM_COPYDATA messages.

The infrastructure of the malicious complex consists of a loader and four key modules, each performing a strictly defined function:

  • STOCKSTAY.MARKETMAKER — the primary loader responsible for deploying and launching the entire system on the infected device.
  • STOCKSTAY.STOCKBROKER — a network tunnel operating through proxy servers. It ensures a stable and encrypted connection with the attackers' servers.
  • STOCKSTAY.STOCKTRADER — the main functional backdoor. This module handles the direct collection of confidential information and the execution of operator commands.
  • STOCKSTAY.STOCKMARKET — the managing "orchestrator." It analyzes configuration files, sets activity intervals, and determines periods when the virus should be in "sleep" mode to avoid detection.

The functionality of the STOCKTRADER module provides hackers with full control over the infected device.

Infiltration Methods and Phishing

The spread of STOCKSTAY is based on social engineering methods. Hackers use phishing emails styled as academic or diplomatic correspondence to deceive employees of government agencies.

At the beginning of 2025, a mass distribution of malicious RDP configuration files was recorded. When opened, such files automatically connected the victim's computer to the attackers' infrastructure. Later, in November 2025, a new wave of attacks against Ukraine began, where the virus was delivered inside RAR archives. This involved the exploitation of the CVE-2025-8088 vulnerability in WinRAR utilities.

It is worth noting that this same vulnerability was actively used by other Russian intelligence services, including the Sandworm, Gamaredon, and RomCom groups. In some cases, attackers used MSI installers or hacked WordPress-based websites to host ZIP archives containing virus components.

Connection to the Kazuar Tool

Google analysts discovered an open repository on GitHub named ChikenFresh/google-ai-labs-it, which stored the management server code for STOCKSTAY, written in Python. The server is designed so that security systems cannot decrypt incoming messages or track the exact location of the hackers' servers.

The similarity in role distribution between STOCKSTAY modules and the structure of the previous Kazuar tool (consisting of Kernel, Bridge, and Worker components) suggests that both tools were developed by the same team of programmers.

In the networks of Ukrainian agencies, the new backdoor was usually deployed at the final stages of an attack, when the infrastructure had already been thoroughly reconnoitered using Kazuar. Experts believe that testing STOCKSTAY in real combat conditions indicates an attempt by hackers to test fresh solutions in case their old access points are blocked by Ukrainian cyber specialists.