Turla

The Russian state-sponsored threat actor Turla has developed a new .NET backdoor called STOCKSTAY, which has been used to target Ukrainian government and military organizations, as well as entities interested in Italian foreign policy. Google Threat Intelligence Group disclosed these details, highlighting the backdoor's ongoing development by the hacking group.

The Russian state-sponsored hacking group Turla has transformed its Kazuar backdoor into a modular peer-to-peer botnet for stealthy and persistent access. Turla is affiliated with Center 16 of Russia's Federal Security Service. This transformation enables Turla to maintain access to compromised hosts.