{
  "name": "STOCKSTAY Another Day: The Latest Addition to Turla\u2019s Intelligence Gathering Apparatus",
  "slug": "stockstay-another-day-the-latest-addition-to-turlas-intelligence-gathering-apparatus",
  "description": "Google Threat Intelligence Group has identified STOCKSTAY, a .NET backdoor continuously developed and deployed by Russia-linked Turla (FSB Center 16) since December 2022. The multi-component malware communicates via secure WebSocket connections and targets government and military organizations in Ukraine, as well as entities interested in Italian foreign policy. STOCKSTAY shares significant code overlaps with KAZUAR, particularly the K1MORPHER obfuscation mechanism. The threat actor employs academic and diplomatic lures, malicious RDP files, and compromised Ukrainian infrastructure for deployment. STOCKSTAY demonstrates environmental keying for configuration protection and operates at multiple operational stages. The malware's modular architecture separates C2 communication, task orchestration, and execution into distinct components, mirroring KAZUAR's design philosophy and indicating shared development resources within Turla's cyber espionage arsenal.",
  "published": "2026-06-25T23:28:29.451000+00:00",
  "created_at": "2026-06-26T08:40:19.121000+00:00",
  "modified_at": null,
  "created_at_opencti": "2026-06-26T08:40:19.121000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "diamondback",
    "k1morpher",
    "kazuar",
    "stockstay",
    "turla",
    "wildday"
  ],
  "tags": [],
  "related_entities": {
    "vulnerabilities": [
      {
        "id": "1a70931c-be20-445c-9c3d-6aaf66288e20",
        "name": "CVE-2026-20245"
      },
      {
        "id": "67c94d1a-bec7-4084-8fb9-15dd2dc6fb57",
        "name": "CVE-2025-8088"
      }
    ],
    "indicators": [
      {
        "id": "b15fb84a-7157-4e81-919f-8468d8a135b8",
        "name": "https://circoloesteri.elezioni.idnet.it/admin-election/riepilogo.php"
      },
      {
        "id": "71220e39-af5a-4e5b-af8d-d6aee6ca2232",
        "name": "6da0b4c1a5d0d3fb6e6a2990a82ba51db1f68a3bba818baa46526a29731e2342"
      },
      {
        "id": "231ebaca-eb35-4a13-9765-833f29c47c4f",
        "name": "f964353b9ae4bedbe62de6c0d7eafa9fb8b87897bbaea483aedaa8ae191834da"
      },
      {
        "id": "188ce775-7c21-4aee-8167-d8d57a410817",
        "name": "81aabf646619ea5f4a72457cd3aa17c5988003d67e6454f45e7cb33613021bac"
      },
      {
        "id": "9db87515-6754-4dd7-a414-f24fbb9e1da4",
        "name": "d3fd32f915c239872c9e7ed9408b1f36dfcef03aa68f9a396d05c437667cdb43"
      },
      {
        "id": "7183397f-d181-4f03-91f1-5695922dadf8",
        "name": "249a4c7cacdd8e99a2a089a5c0ce904f2eff22e0e40fcfb10f7824dca6c51ecb"
      },
      {
        "id": "c7f50a62-5a97-4c98-b3f9-3c60adf3cef9",
        "name": "e83f274bf9914c6cfc0c6b3cdadf089565f49dace4aca93287c22aba9641c8f3"
      },
      {
        "id": "a9a0cdb8-b6b1-420f-916b-4fa8e48fc18c",
        "name": "6298f3150ad94a242e649886d47c59c634a4d04b9af5ee15e3bf335c40b5e58e"
      },
      {
        "id": "a2d59e2b-7f87-4e04-bfe0-faf2a64fea97",
        "name": "2af7b513c05e76d7da5f75bb0a223c894a706c99ef2c2ddfe4eae542f95a08e0"
      },
      {
        "id": "8e0932c8-b8f4-451b-afba-0663800a5533",
        "name": "19e6ed42248f9d03beb343a7c09a864dcd3cd671c29e1e5eac93579225224ac9"
      },
      {
        "id": "0fb12a93-f69c-4338-999d-04b9ac3f6813",
        "name": "7615140f78d9a0ce31cc9fe8c54c60028a7439cb32526fd97b10afef7145dd78"
      },
      {
        "id": "bc6a40bb-650a-40f0-83ca-27a5a56aa9cd",
        "name": "d1e54270433a94aa3d45d888e4c62299bee3480eb2cb4a5489c7dda69d476c3e"
      },
      {
        "id": "9c5c7197-3591-467e-8000-3ab30c3d0791",
        "name": "1682e8d82016b3f10434d2ebac995fd3b6aa812f079bfd7888652e94a994d851"
      },
      {
        "id": "0ee54700-efc6-4200-b1bc-a115d05d48ff",
        "name": "55249f296b63a8bcf911b8bc96de43c1ac2b4a56c150a19d33d892a47e57352c"
      },
      {
        "id": "9cac4548-e241-4194-a8b4-0eefecf0876c",
        "name": "b55f3b8a7334af049ba3f70a9ad3fe78574b1e180c68baf9a7110d104387a636"
      },
      {
        "id": "bc589c03-1819-4cf5-84da-f179c9a02da6",
        "name": "82707cfdf24dcb762f4615f01e1ba4d3dfdec4abe9cd588558d2634d7e6a5eeb"
      },
      {
        "id": "ffd6ebff-c12a-49e3-89b0-fe04d3fbfea4",
        "name": "https://www.circoloesteri.it/"
      },
      {
        "id": "b976addc-2ad1-48a2-a3e8-20071a76dcf8",
        "name": "d8fe8f3fe838d5b1a1043096f6f6bb6f524f5f1b0c9f83a081078a824daa0cf3"
      },
      {
        "id": "f284f287-dc28-4042-a5aa-9ee412656e3f",
        "name": "e1d16fb635060d23e889b0617d77f0cf06d00cc19b43a2c8b5ac53ac027ac722"
      },
      {
        "id": "a1c93fea-95e0-40dd-9f07-6a372b2f9b38",
        "name": "9fe944147c15a87963b06baf6473288d64c23655a0ba9369c35566272d8efc73"
      },
      {
        "id": "259844d3-db36-41de-bf1e-ad05269596e7",
        "name": "e3364ee21cae6725451e8bc9ab9933df0000fd19814170bd132da68d1906d5ff"
      },
      {
        "id": "de4d1f06-27cb-4c39-a760-4a8ca4aeb4e9",
        "name": "e316b1e13154dc6115e1e0c023f6fe3d17861cae839d4a4a81779b6aad9a24f8"
      },
      {
        "id": "e25fc1ed-2e4f-4c79-a105-b6681d96eb39",
        "name": "391e51354118fb87dc57650cbbd94258c3f7c0a0d6868040b7a473ad626ff25e"
      },
      {
        "id": "69955f5f-4ec9-4210-a424-751e78af1c8f",
        "name": "447f430b46fad5a3f8e8c5aad1f8f7f79af069489c3d9c29224bb9f14f0c7bf4"
      },
      {
        "id": "c49bf905-9f90-403b-8a7d-b99810b1ee44",
        "name": "http://weatherdataai.theworkpc.com/ws"
      },
      {
        "id": "e1d732dd-f145-48a1-9fa7-56639070f4e0",
        "name": "626330d22f77d9cbca9d40cc06568041703f194610c4c5a84bbb05a2e4ee7459"
      },
      {
        "id": "9fb40c04-8e55-4353-b93f-41230d649a8f",
        "name": "1fc23ec18a94a599a34c74ef5f49a1e27acd37a07d5846661702b5e7e81a6a24"
      },
      {
        "id": "135c20f9-55d8-4989-b5ab-d10a782f994c",
        "name": "667a8f568a611f2f3d84a366b7946b360e055bece9699c95aad619637ab72a38"
      },
      {
        "id": "df6740a3-08ab-4fa1-85cb-040af0b4915f",
        "name": "77417df21b4b4e8d86b8bda4afeef93fd36f355362586b2d1f51121a82244167"
      },
      {
        "id": "711b3294-33ab-43ee-8081-419f995549a9",
        "name": "b064a3efb04ed77e6c57955089ce639e193d166c8ea2216c98c3e9b701ea2cff"
      },
      {
        "id": "f9f582db-6d8a-43f1-a6f6-88e051f5987f",
        "name": "b287347a5bff8af360ce0e6500c336b6fe6d97920abc26202c9d843ffebc5f89"
      },
      {
        "id": "c12ead18-745f-4396-b671-7a4458b01d05",
        "name": "2623c6e3c1f5a7b5e735a64813bc0e1382ae45831f5fadffb08c0e7b096627f7"
      },
      {
        "id": "699ec3e6-55fb-4862-a3ca-bbe65375ad15",
        "name": "dfd5cb91d06b9649d4cab500343af80ad1144a9e46641cc406f43dd169003c22"
      },
      {
        "id": "ecc0b047-14a6-476d-a4a6-674b83767108",
        "name": "34fcbe7e90fc87a4f3766469c19a64f24672d7adb99e0198f5ba10d58911368b"
      },
      {
        "id": "8297ba3a-1d1b-446a-9759-323e57ebff8c",
        "name": "40a3b969d81ef1ef35dd9ebcc6774e060b1b8949d3d74f38ca6b7d789c95cdb3"
      },
      {
        "id": "de44dfba-c329-4566-8c92-c76702a2ec63",
        "name": "40b1208dda0cd5dd95c6b57764b2cfe7145b3ed9457f498408b4aaa05bf3ef50"
      },
      {
        "id": "b579346c-33ce-410f-8738-b3f1136cfae7",
        "name": "https://www.drs.gov.ua/wp-content/themes/twentytwentyfive/docs.zip"
      },
      {
        "id": "556f4bcd-3c41-4091-ba4e-ecd776cf8b93",
        "name": "6cee9e838792ac5e2098362d68ce93a9a2c095d476dc16b289fe8509c99b2b8b"
      },
      {
        "id": "4643a6c5-377a-4559-a881-7c7ffa1091ff",
        "name": "45bb8d1ab2c13bf4354294e13d3c9be15de625d807301905b98462f43f93e893"
      },
      {
        "id": "9390fcef-2ee2-4f6d-9846-9c670fd1faa7",
        "name": "a40bf9c75d1bfa6d66f1179f2321de6589f80d3089d992797a9cb0e84f6196ce"
      },
      {
        "id": "6d696d78-77fd-4023-ac3a-b49ef0fbdbdf",
        "name": "e2a0f4440f67998a0215d49be31746ea192bfcb4dc4ee532a218f8cf13605714"
      },
      {
        "id": "ffa14d20-96d2-4344-a183-32ce26fba1e9",
        "name": "3627f582420ad2782d452fe6d13fae42658d1484296351d3916703e25dcadd14"
      },
      {
        "id": "02f7bd55-39db-4096-86dd-8cc716b42193",
        "name": "9164054d0bf0b7c8820da4f742860940998984555e65820e4fa8dd07b6bd67ec"
      },
      {
        "id": "650dfbfd-e842-4671-b4d8-fbe262adb2d2",
        "name": "https://online.zp.ua/wp-content/uploads/Tools/EditorToolsPdf.zip"
      },
      {
        "id": "d85bd66f-4010-4ec2-bce2-2cf1660ea31c",
        "name": "f04f43b6f7c2d86109c495179b497f7fb45fd95816623de1b77900f71b4f99ed"
      },
      {
        "id": "0252a341-1ce0-498f-8f38-ed990856bfe4",
        "name": "da8a96bc74e265f945f1cc6992c6dc0f9ea36ed1991f7b8d312db79d9bf78c40"
      },
      {
        "id": "679cb33e-922c-4819-96ad-8fa899a0eb73",
        "name": "https://basecon.com.ua/calculator.rar"
      },
      {
        "id": "48ddc2fb-fdfd-415a-b821-c471fc21209c",
        "name": "0a545dd1b703cddfb3d582c8c70f65f556bbd580bfa836a387121eb837bda61b"
      },
      {
        "id": "030e6fef-30fb-4b79-bc7e-aeaa7debd98f",
        "name": "b728eba4f0d6d16602fbad05a591f14391594262d3584b2e249e97f86e4dcc5a"
      },
      {
        "id": "57ba6c0a-f35e-40b2-b3be-b943ea3d6ff7",
        "name": "c905cb512018cc55512c6a22677c3d6f389c47afd54d7c85797868fc4fcb90e9"
      },
      {
        "id": "1eee8c3c-b37f-426a-8549-6cc3405a90ef",
        "name": "4e3bed10a8eff3e9205c1f37f647512464271d5ac65df7ae4709735621a38320"
      },
      {
        "id": "083c2e0f-b4ca-4722-aac1-678ecd2ac4e1",
        "name": "98ce3c6e4dd05887ea619f2bbfeb2e2c2805ed07e85e119b79b828b7ef8be397"
      },
      {
        "id": "c905e4e8-23bc-45a1-83f8-775276a58a89",
        "name": "80f6c010fd260d0bcf18a4b6a8d62505adbed50d2e615ed9522c4bfd61c00661"
      },
      {
        "id": "89f9424e-2338-4bd2-84ff-2903d534997f",
        "name": "e6d8192960a89d5480868b94088cccdaa1560f9c8a0b0282ced2b7c1f72341b6"
      },
      {
        "id": "3643164a-5f2e-4119-87c5-329d666fac53",
        "name": "0d6b083208097d5b3e189891338540f6c64faaaaf268b0bb0b085dd53d5857b4"
      },
      {
        "id": "03c48843-e0d8-4aee-a0b0-b7d1a6fc4aa1",
        "name": "1a2ca8b8e0344fe3d80da7352206a470245443e2349a237bc093df934ddc011f"
      },
      {
        "id": "09b59e63-605e-4a93-aa17-47c95ee49e4e",
        "name": "813c78b5b6ef28a9c0ed35f2c6cd88fc50880ab91f8777dfe7aaccb1c24b08d5"
      }
    ],
    "intrusion_sets": [
      {
        "id": "3feb3f70-b3fd-4f5c-b0d6-0e0369c25a93",
        "name": "Turla",
        "slug": "turla"
      }
    ],
    "attack_patterns": [
      {
        "id": "c473a756-355a-42ad-a0df-cd3a8fa006d1",
        "name": "T1057"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "a72ebeae-8e62-4039-8135-e9c611011fdc",
        "name": "T1573"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "ca53b2fa-42a8-45ec-9682-0cf54bf280f3",
        "name": "T1090"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "09124a92-c11f-4571-b35b-ab0bce6dd081",
        "name": "T1112"
      },
      {
        "id": "dc410646-9cdd-427b-92e7-179a54f78f90",
        "name": "T1566.001"
      },
      {
        "id": "6b2e0999-c7e8-4662-94ac-19aa8520ee46",
        "name": "T1059.003"
      },
      {
        "id": "97d377d8-89c7-48f8-a79f-0f48bd60df74",
        "name": "T1005"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "1584b551-72fb-4f60-ba7a-bdac106e6f9b",
        "name": "T1560.001"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "52b92395-d3d3-4e05-976a-0fccccfce8d2",
        "name": "T1566.002"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "8e0fea81-4d54-4e88-a7dd-3aa8b26558ed",
        "name": "T1113"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "fa3b8b48-d97c-4242-83a6-07d435a5a79e",
        "name": "T1041"
      }
    ],
    "malware": [
      {
        "id": "4d86f834-caba-4287-a4f9-aa693000aca7",
        "name": "STOCKSTAY",
        "slug": "stockstay"
      },
      {
        "id": "0304a4b3-01a9-4719-b413-de4bf5a951d0",
        "name": "WILDDAY",
        "slug": "wildday"
      },
      {
        "id": "c951fc9f-78dc-4c27-986e-0e2a1e8d6236",
        "name": "STOCKSTAY.STOCKBROKER",
        "slug": "stockstaystockbroker"
      },
      {
        "id": "ffbf56b6-4aa6-4879-be4c-40099e957805",
        "name": "DIAMONDBACK",
        "slug": "diamondback"
      },
      {
        "id": "1ef2a346-3138-4b99-88f4-5e45102770c1",
        "name": "STOCKSTAY.STOCKTRADER",
        "slug": "stockstaystocktrader"
      },
      {
        "id": "2182b8c9-e024-4848-b2a9-a01bdf829106",
        "name": "STOCKSTAY.MARKETMAKER",
        "slug": "stockstaymarketmaker"
      },
      {
        "id": "201806db-fac3-4962-8078-22af3c88023d",
        "name": "Kazuar - S0265",
        "slug": "kazuar-s0265"
      },
      {
        "id": "cf4ffcc5-8fa0-408e-a104-1d56a0b14d43",
        "name": "STOCKSTAY.STOCKMARKET",
        "slug": "stockstaystockmarket"
      }
    ],
    "observables": [
      {
        "id": "ebf80b17-0ffc-4ced-8ba0-124eb37451d6",
        "name": "https://circoloesteri.elezioni.idnet.it/admin-election/riepilogo.php"
      },
      {
        "id": "42213154-0955-4e9c-88d7-c2aa6b0606d1",
        "name": "http://weatherdataai.theworkpc.com/ws"
      },
      {
        "id": "02249833-6fd9-463d-af79-7096a9a8b8ca",
        "name": "https://www.circoloesteri.it/"
      },
      {
        "id": "266fd03a-1256-4082-bce4-ee1570d6aa9e",
        "name": "https://www.drs.gov.ua/wp-content/themes/twentytwentyfive/docs.zip"
      },
      {
        "id": "57013a56-dc06-4199-a69c-6d29288e2021",
        "name": "https://online.zp.ua/wp-content/uploads/Tools/EditorToolsPdf.zip"
      },
      {
        "id": "35bc8380-3db6-4e5b-b480-a46216167546",
        "name": "https://basecon.com.ua/calculator.rar"
      }
    ]
  },
  "external_refs": [
    {
      "id": "071d9139-438a-4ddc-bbf1-7eb9c1ab286a",
      "standard_id": "external-reference--17805bef-7923-5106-a58e-52f375b43def",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/stockstay-turla-intelligence-gathering",
      "hash": null,
      "external_id": null,
      "created": "2026-06-26T08:40:12.923Z",
      "modified": "2026-06-26T08:40:12.923Z",
      "createdById": null
    },
    {
      "id": "c37cfbc6-1ddd-4339-b68a-b55a11f1ffb7",
      "standard_id": "external-reference--ffe36fdc-5b48-56cf-a43a-797deef28b0d",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a3db99d3f27ba984f5154ff",
      "hash": null,
      "external_id": "6a3db99d3f27ba984f5154ff",
      "created": "2026-06-26T08:40:12.859Z",
      "modified": "2026-06-26T08:40:12.859Z",
      "createdById": null
    }
  ]
}