Google Reveals Details on Turla's STOCKSTAY Backdoor Targeting Ukraine

Introduction of STOCKSTAY

The STOCKSTAY malware was identified by Google's Threat Intelligence Group as a new backdoor linked to the Russian threat actor Turla. This sophisticated tool has been used against various government and military entities within Ukraine and those involved in Italian foreign policy, indicating its broad targeting scope.

Technical Aspects of STOCKSTAY

STOCKSTAY operates as a multi-component backdoor developed using the .NET framework. Its architecture includes distinct components that communicate via inter-process communication, using the Windows Forms framework and secure WebSocket connections. This design allows for flexible and remote control of compromised systems.

The backdoor's functionality overlaps with earlier implants like Kazuar, emphasizing the ongoing evolution of Turla's cyber tools.

Operational Components

STOCKSTAY is structured around several modules: STOCKSTAY.MARKETMAKER serves as the downloader, while STOCKSTAY.STOCKBROKER manages network communication, and STOCKSTAY.STOCKTRADER is the main backdoor for data exfiltration. Additionally, STOCKSTAY.STOCKMARKET acts as the orchestrator to control these components, determine execution parameters, and handle communications.

Functionality and Commands

The backdoor includes several operational commands enabling the attacker to manipulate files and capture information. Key commands include Del (to delete files), Dir (to enumerate directories), Get (to retrieve specified files), and Image (to take screen captures). These functionalities provide the attackers with significant control over compromised systems.

Conclusion

The emergence of STOCKSTAY highlights the continuing advancements in cyber espionage techniques employed by state-sponsored actors. As the landscape evolves, understanding these tools is crucial for organizations to enhance their cybersecurity measures against potential threats.