STOCKSTAY: Turla unleashes a modular backdoor .NET with encrypted WebSocket and IPC evasion that elevates its high value campaigns

The threat known as Turla, linked to Russian state interests, has shown a technical and operational evolution with the emergence of a new backdoor in .NET baptized by researchers as STOCKSTAY. More than just a substitute, STOCKSTAY seems to have been designed from scratch with a modular architecture and with clear reminiscent of the KAZUAR ecosystem, the platform that this actor has used and refined for years.

STOCKSTAY stands out for three technical features that make it especially dangerous for high-value objectives: its development in .NET using Windows Forms, the encrypted communication via WebSocket (implemented with the websocket-sharp bookstore) and the division into several modules that communicate with each other using IPC using WM _ COPIDATA messages. This role separation - download, proxy tunnel with WebSocket, controller and main backdoor - facilitates your sigil, persistence and replacement or updating of individual components without affecting the set.

The observed delivery vectors are not novel but effective: speed-phishing campaigns with diplomatic or academic lures, RAR files that exploit WinRAR vulnerabilities (referred to as CVE-2025-8088 in reports), malicious RDP attachments that establish connections to infrastructure controlled by the attacker, MSI and HTA installers housed in public repositories or compromised sites. In addition, the campaign has served both to obtain initial access in non-previous environments and to move laterally and to run the backdoor on specific machines already identified by the attackers.

From a strategic perspective, the reuse of ideas and components between STOCKSTAY and KAZUAR suggests two possibilities that involve different risks: on the one hand, that the same or a overlapping development chain maintain both toolkits; on the other, that Turla is using a laboratory approach in production, testing new capabilities in real operations. In both cases, the modularity and tactic of using committed WordPress sites or public repositories to host stages of the attack increase the difficulty of detection and attribution.

The implications for governments, ministries and companies exposed to foreign policy are clear: the attack surface is focused on directed social engineering and delivery chains that combine vulnerabilities and legitimate content housed in third parties. This requires controls that are not limited to static signatures but to the detection of behavior, network telemetry and correlation of events between mail, endpoint and outgoing traffic.

In order to reduce exposure and response time, practical and prioritized measures are essential. First, immediately park components of critical third parties and remove vulnerable versions of programs such as WinRAR; second, tighten mail policies by blocking or inspecting with attached sandbox .htm, .hta, .rdp, .msi and .rar from unverified shipping; third, deploy EDR / telemetry that records .NET process creation with Windows Forms UI that establish external connections and WM _ COPIDATA activity between processes, as that IPC channel is distinctive of this malware family.

In network, it is appropriate to control and analyse unusual outgoing WebSocket traffic, especially encrypted connections to servers that are not listed as part of normal activity. The encrypted nature of the channel can prevent deep inspection, so you have to add detection based on behavior patterns (e.g. internal processes that activate proxy tunnels or establish multiple WebSocket connections from internal hosts) and reputational blocking of known domains and IP addresses.

Operatively, it is recommended to segment sensitive environments, revoke credentials that may have been compromised after a phishing campaign and carry out proactive search of indicators on endpoints and servers. In addition, auditioning internal WordPress facilities and public sites that the organization manages can prevent legitimate repositories from becoming vectors to deliver payloads.

For response teams and analysts, Google's research highlights the existence of a public repository that implements the control of WebSocket server on the victim side, which poses risks of re-use by other actors and makes it difficult for technical attribution to encode incoming messages. It is advisable to share telemetry and IOC with national intelligence units and CERT and to rely on third-party and community analysis to identify ongoing campaigns; general resources on the actor and his / her history can be consulted in public documentation of threat groups such as MITRE ( https: / / attack.mitre.org / groups / G0010 /) and in the reports of response teams such as Google TAG ( https: / / blog.google / menat-analysis-group /).

In short, STOCKSTAY is not just a new piece of malware: it is the expression of a mature operational policy that combines modularity, evasion and targeted social engineering campaigns. The defense requires a combination of parking, tightening of the mail, advanced telemetry and coordination between teams. For organizations in sensitive sectors, immediate action is to prioritize patches and mail controls, activate behavior-based detection in endpoints and networks, and prepare response processes that consider the possibility of covert and multi-stage commitments.