Google Says Turla Used StockStay Malware to Spy on Ukrainian Targets
Summary
Google says Turla developed StockStay since at least December 2022, mainly targeting Ukrainian government and defense organizations. The malware shares code with Kazuar and was delivered through phishing emails with malicious RDP configuration files.
Key points
- Google researchers say StockStay has been under active development since at least December 2022.
- The malware was primarily used against Ukrainian government and defense organizations; early samples were also found in Italy, the Netherlands, Poland and Germany.
- StockStay shares significant code and functionality with Turla's Kazuar framework.
- Victims were typically targeted with phishing emails containing malicious Remote Desktop Protocol configuration files.
- StockStay evolved from masquerading as a stock market application to posing as PDF readers and calculator programs.
- Google said Turla uses parallel malware ecosystems to help maintain access when individual tools are discovered and remediated.
Article Details
- Event Type
- Cyber-espionage campaign involving the development and deployment of StockStay malware against Ukrainian government and defense organizations, with early samples also identified in several European countries.
- Impact
- StockStay was used to spy on targets and maintain attacker access. Phishing emails with malicious RDP configuration files connected compromised computers to attacker-controlled infrastructure, enabling the deployment of additional malware. The article reports no quantified impact.
MITRE ATT&CK
Threat Actors
Malware
Countries
GermanyIt was primarily used to target Ukrainian government and defense organizations, although early samples of the malware were also identified in Italy, the Netherlands, Poland and Germany.ItalyIt was primarily used to target Ukrainian government and defense organizations, although early samples of the malware were also identified in Italy, the Netherlands, Poland and Germany.NetherlandsIt was primarily used to target Ukrainian government and defense organizations, although early samples of the malware were also identified in Italy, the Netherlands, Poland and Germany.PolandIt was primarily used to target Ukrainian government and defense organizations, although early samples of the malware were also identified in Italy, the Netherlands, Poland and Germany.RussiaTurla, also tracked as Secret Blizzard and Venomous Bear, is one of Russia’s longest-running cyber-espionage groups and has been linked by Western governments and cybersecurity researchers to Russia’s Federal SecurityUkraineGoogle said StockStay shares significant code and functionality with Kazuar, another Turla malware framework previously used in cyberespionage operations against military and defense targets in Ukraine.