A newly detailed cyber-espionage campaign is using fake remote desktop files and a recently patched WinRAR flaw to plant a stealthy backdoor called STOCKSTAY on computers in Ukraine.
The malware disguises itself as everyday software, including stock market trackers and calculator apps, to avoid raising suspicion while it quietly collects information from infected machines.
STOCKSTAY is built in .NET and made up of several separate components, each handling a different job such as talking to its controllers, moving files, or running commands.
This modular design lets the attackers swap pieces in and out without rebuilding the whole tool, making the malware harder to fully dismantle once discovered.
Researchers at Picus Security have been tracking this activity as part of a broader look at the threat group behind it, known as Turla or Secret Blizzard.
The group has been linked to Russia’s Federal Security Service and has run espionage operations since 2004, making it one of the longest active state backed hacking teams in the world.
Turla’s recent operations have leaned heavily on tricking victims into opening booby trapped files rather than using flashy exploits alone.
In one case, a compromised university email account sent out a malicious RDP configuration file disguised as a distance learning trial, which quietly opened an outbound connection to attacker controlled servers.
Picus Security said in a report shared with Cyber Security News (CSN) that the group also weaponized a WinRAR path traversal bug, tracked as CVE-2025-8088, to drop STOCKSTAY files straight into a victim’s startup folder during archive extraction.
STOCKSTAY Backdoor Uses Malicious RDP Files
The malicious RDP files act as a simple but effective doorway. Once a victim opens one, it silently connects out to infrastructure controlled by the attackers, which then pushes down additional payloads onto the machine without any obvious warning signs.
The WinRAR exploit takes a different but equally sneaky route. A booby trapped RAR archive, sometimes disguised as a military pay calculator tool, exploits the path traversal flaw so that simply extracting the archive writes STOCKSTAY components and shortcut files outside the folder the user expects.
Those shortcuts, given innocent sounding names like MSViewer.lnk and MSDriver.lnk, get placed in the Windows startup folder so the backdoor automatically restarts every time the computer boots up. This gives the attackers a durable foothold that survives simple reboots or basic cleanup attempts.
Hiding Command And Control Traffic
STOCKSTAY does not talk directly to a single attacker controlled server. Instead, its traffic passes through legitimate cloud platforms such as serverless hosting services and browser app platforms, letting the malicious communication blend in with ordinary web traffic.
The malware even uses a technique that resembles a dead drop mailbox, where infected machines and the attacker’s operators both check the same relay for messages instead of contacting each other directly.
This setup makes it much harder for network defenders to spot a clear line between victim and controller. Adding another layer of stealth, STOCKSTAY encrypts its own configuration data using a hash based on the victim’s hostname.
This means a captured sample cannot simply be analyzed on a researcher’s own machine, since the decryption key depends on the exact system it was meant to infect.
Given these techniques, security teams are encouraged to test their defenses against known Turla behaviors rather than relying on signature detection alone.
Simulating these attack patterns can help organizations spot gaps before real intrusions occur, and reviewing outbound connections to unfamiliar cloud hosting services is a practical first step for defenders.
Since Turla frequently disguises its tools as common utilities and hides its traffic inside trusted platforms, basic awareness training around unexpected RDP files and unsolicited archive attachments remains one of the simplest ways to reduce risk.
Keeping WinRAR and similar archive tools updated also closes off one of the entry points seen in these attacks.
Indicators of Compromise (IoCs):-
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
