Back Thehackernews

Google Details Turla's New STOCKSTAY Backdoor Used in Ukraine Espionage Attacks

Thehackernews • June 26, 2026

Learn how to uncover hidden AI use, see what data it can access, map every AI action to a human owner, and apply practical governance without heavy infrastructure changes.

Learn how to contain Mythos-style AI attacks with practical Zero Trust controls that reduce exposure, stop lateral movement, and limit risk.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New Russian STOCKSTAY Spyware Targets Ukrainian Military Google Threat Intelligence has identified a new spyware named STOCKSTAY, developed by the Russian hacking group Turla, aimed at Ukrainian military and government entities. This Windows backdoor is designed for cyber espionage and has been in development since at least December 2022. STOCKSTAY shares significant code similarities with the Kazuar spyware, which has been active since 2017. The malware operates through a multi-component architecture and uses secure WebSocket connections for communication with its command-and-control server. Attackers have employed social engineering tactics, such as phishing emails related to education and diplomacy, to lure victims. While primarily targeting Ukraine, early versions of STOCKSTAY were also tested on institutions in Italy, the Netherlands, Poland, and Germany. Analysts suggest that the simultaneous use of STOCKSTAY and Kazuar indicates a testing phase for the new malware in real-world conditions. 9 sources 74

Extracted Entities

Google Details Turla's New STOCKSTAY Backdoor Used in Ukraine Espionage Attacks

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Countries (1)

Malware (1)