The Russian state‑sponsored group Turla has been linked to a previously unknown . NET backdoor named STOCKSTAY. Google’s security researchers discovered the tool in mid‑2026. It has been deployed against Ukrainian government and military networks, as well as organizations monitoring Italian foreign policy.
Google says the malware was first seen in early 2026, targeting Ukrainian ministries and defense units. The backdoor allows attackers to execute commands, exfiltrate data, and maintain persistence on compromised systems. Its . NET framework makes detection harder on Windows environments that rely on Microsoft runtimes. Researchers attribute the campaign to Turla because of code reuse and shared command‑and‑control infrastructure with earlier Turla tools.
STOCKSTAY’s design differs from Turla’s classic C++ implants. The backdoor embeds a lightweight . NET loader that can fetch additional modules on demand. This modular approach lets the group adapt quickly to defensive measures. Google’s analysis shows the loader encrypts its payloads with a custom algorithm, complicating static analysis. The team also noted that the malware uses legitimate Windows services to hide its network traffic, reducing the chance of triggering alerts. Such sophistication suggests Turla is investing in newer development skills to stay ahead of security tools.
Beyond Ukraine, the backdoor was found on servers belonging to think tanks and NGOs that track Italy’s diplomatic moves. Analysts believe Turla aims to gather intelligence on Italy’s stance toward NATO and Eastern Europe. By compromising these entities, the group can influence regional narratives or anticipate policy shifts. The choice of Italian targets aligns with recent Russian efforts to monitor European allies that support Ukraine. Google’s report highlights that the same command‑and‑control servers served both Ukrainian and Italian‑focused victims, indicating a unified operation.
The discovery underscores the growing threat posed by state‑backed cyber actors using modern development platforms. As Turla adopts . NET, defenders must adjust detection strategies to cover newer code bases. Ongoing monitoring of network traffic and behavior‑based alerts will be crucial. Google plans to share indicators of compromise with industry partners to help mitigate further intrusions.
What is the primary function of the STOCKSTAY backdoor? It enables remote command execution, data theft, and persistent access on compromised Windows machines, using a modular . NET loader.
How did Google identify the malware as Turla’s work? Researchers matched code patterns, shared infrastructure, and command‑and‑control signatures with previously known Turla tools.
Can the backdoor be detected by traditional antivirus solutions? Standard signature‑based tools often miss it due to its encrypted payloads and legitimate service usage; behavior‑based detection is recommended.