Turla StockStay backdoor targeting Ukrainian government and military networks

Intelligence Summary

A Russian-linked APT known as Turla is deploying the StockStay backdoor against Ukrainian government and military organizations. The campaign focuses on espionage and likely aims to maintain long-term access. Using a specialized backdoor, the attackers can blend into compromised environments while collecting sensitive information. Organizations in Ukraine should review for indicators of StockStay activity and related persistence. Network defenders should also ensure endpoint monitoring and incident response procedures can rapidly detect unusual communications and tooling.

Recommended Action

Review affected assets, schedule urgent remediation, and monitor related indicators.

Topics