STOCKSTAY — Turla / Secret Blizzard Multi-Component .NET Backdoor

STOCKSTAY is a multi-component .NET (Windows Forms) backdoor developed and operated by Turla (aka SUMMIT, Secret Blizzard, VENOMOUS BEAR, UAC-0194) — a Russia-nexus (FSB-linked) espionage actor. Google Threat Intelligence Group (GTIG) published an in-depth analysis in June 2026 showing continuous development and deployment of STOCKSTAY since at least December 2022, primarily against Ukrainian government and military organizations and European entities with an interest in Italian / EU foreign policy.

The implant splits into four roles — an orchestrator (STOCKMARKET), a proxy-aware WebSocket tunneler (STOCKBROKER), a command executor (STOCKTRADER), and a downloader/installer (MARKETMAKER) — that communicate over IPC (WM_COPYDATA) and talk to C2 over secure WebSocket (wss://) using the open-source websocket-sharp library, often relayed through free-tier PaaS (.onrender.com, .glitch.me) and compromised WordPress sites. STOCKSTAY shares code, multi-component design, and environmental-keying with Turla's KAZUAR toolkit, indicating a common development team.

Delivery is by spearphishing: malicious .rdp attachments, RAR archives exploiting WinRAR CVE-2025-8088 (path traversal that drops autostart payloads), masqueraded MSI installers, and Ukrainian-language HTA decoys that rename a .dat file to .dat.exe. Persistence is a CurrentVersion\Run autorun written by MARKETMAKER, with components installed under %LOCALAPPDATA%\Programs\SMN\.

Defender priority: The highest-value, lowest-FP angles are the campaign-specific masquerade binary names (StockMarket*/MS{Viewer,Driver,Render}/MicrosoftUpdateOneDrive), the CurrentVersion\Run + Programs\SMN persistence pair, the GTIG-published file hashes, and DNS/WebSocket beacons to the five known C2 hosts. Patch WinRAR to ≥ 7.13 and strip .rdp/HTA at the mail gateway to cut the delivery chain off at the front.

Atomic IOCs (hashes, C2 hosts, filenames) below trace to the GTIG report's published indicator set. Treat WebSocket C2 hosts as perishable (free-tier PaaS rotates); the masquerade filenames, install path, and Run-key behavior are durable across waves.

Hunt hypotheses (fidelity-ordered)

1. H1 (high): A STOCKSTAY component runs under one of its campaign-specific masquerade names (StockMarket*, MS{Viewer,Driver,Render}, MicrosoftUpdateOneDrive, ClientMNGR). Covers T1036.005.
2. H2 (high): MARKETMAKER wrote a CurrentVersion\Run value pointing at a component or Programs\SMN. Covers T1547.001.
3. H3 (high): A file matching a GTIG-published STOCKSTAY hash executed or was written. Atomic.
4. H4 (high): A host resolved one of the five known STOCKSTAY WebSocket C2 hosts. Covers T1071.001.
5. H5 (medium): A process executes from %LOCALAPPDATA%\Programs\SMN\. Install-path tell.
6. H6 (medium): WinRAR/archive extraction (CVE-2025-8088) dropped a payload into Startup or Programs\SMN. Covers T1203 + T1547.001.
7. H7 (medium): mstsc launched from a mail/Downloads .rdp attachment. Covers T1566.001 + T1021.001.
8. H8 (medium): mshta executed an HTA decoy that spawned a renamed .dat.exe. Covers T1218.005.

Attack chain

All values published by GTIG. WebSocket C2 hosts are perishable; hashes and filenames are durable. Validate against your own retention window before bulk-blocking.

• Mail gateway: Search the last 90 days for inbound attachments with extensions .rdp, .hta, and .rar containing .lnk/.exe — especially Ukrainian/Italian-language filenames or "calculator"/"diplomacy"/"UAV" themes.
• WinRAR version inventory: Audit deployed WinRAR builds; anything < 7.13 is exposed to CVE-2025-8088. (See playbook P1.)
• Sysmon (where deployed): Event ID 11 file-creates of *.dat.exe, and Event ID 13 Run-key writes referencing Programs\SMN.
• Proxy / NGFW: Review WebSocket (Upgrade: websocket) sessions to *.onrender.com, *.glitch.me, and recently-registered or low-reputation domains on URI path /ws.
• YARA: Run GTIG's published rules (G_Backdoor_STOCKSTAY_*, G_Hunting_K1MORPHER_*) against endpoint file collections / VT retrohunt.

Promotion path: validate the high-CONF/low-FP queries (Q1, Q2, Q9) against 7–14 days of baseline, confirm zero benign hits, then promote to Custom IOAs in detect mode; escalate Q9/Q1 to block once clean. Q3 hashes → Custom IOC Management (block).

One-click blocks for SOC tooling. Hashes and C2 hosts are GTIG-published; swap expirations to fit your policy.

type,value,action,severity,expiration,description,tags
sha256,82707cfdf24dcb762f4615f01e1ba4d3dfdec4abe9cd588558d2634d7e6a5eeb,prevent,critical,2026-12-29,STOCKSTAY STOCKMARKET,campaign:STOCKSTAY;actor:Turla
sha256,34fcbe7e90fc87a4f3766469c19a64f24672d7adb99e0198f5ba10d58911368b,prevent,critical,2026-12-29,STOCKSTAY STOCKBROKER,campaign:STOCKSTAY;actor:Turla
sha256,0a545dd1b703cddfb3d582c8c70f65f556bbd580bfa836a387121eb837bda61b,prevent,critical,2026-12-29,STOCKSTAY STOCKTRADER,campaign:STOCKSTAY;actor:Turla
sha256,da8a96bc74e265f945f1cc6992c6dc0f9ea36ed1991f7b8d312db79d9bf78c40,prevent,critical,2026-12-29,STOCKSTAY MARKETMAKER,campaign:STOCKSTAY;actor:Turla
sha256,1fc23ec18a94a599a34c74ef5f49a1e27acd37a07d5846661702b5e7e81a6a24,prevent,critical,2026-12-29,STOCKSTAY combined,campaign:STOCKSTAY;actor:Turla
domain,canal1zac1a.onrender.com,detect,high,2026-09-29,STOCKSTAY wss C2,campaign:STOCKSTAY;actor:Turla
domain,google-ai-labs-it.onrender.com,detect,high,2026-09-29,STOCKSTAY wss C2,campaign:STOCKSTAY;actor:Turla
domain,driverx86-adobe.onrender.com,detect,high,2026-09-29,STOCKSTAY wss C2,campaign:STOCKSTAY;actor:Turla
domain,weatherdataai.theworkpc.com,detect,high,2026-09-29,STOCKSTAY wss C2,campaign:STOCKSTAY;actor:Turla
domain,wool-basalt-clock.glitch.me,detect,high,2026-09-29,STOCKSTAY wss C2,campaign:STOCKSTAY;actor:Turla

[ STOCKSTAY behaviors ]
- Process image path under %LOCALAPPDATA%\Programs\SMN\
- Binary named StockMarket{View,Net,System,News}.exe / SMNet.exe / SMEditor.exe
- Binary named MS{Viewer,Driver,Render}.exe / ClientMNGR{,2}.exe / ConverterDDSNet.exe
- Downloader masquerading as MicrosoftUpdateOneDrive.exe
- CurrentVersion\Run value referencing a component or Programs\SMN
- wss:// to *.onrender.com / *.glitch.me on URI path /ws
- mshta.exe -> *.dat.exe child
- mstsc.exe (.rdp arg) child of outlook/olk/browser

Actor:   Turla (SUMMIT / Secret Blizzard / VENOMOUS BEAR / UAC-0194)
Implant: STOCKSTAY (.NET / Windows Forms, websocket-sharp wss:// C2)
Roles:   STOCKMARKET (orchestrator), STOCKBROKER (tunneler),
         STOCKTRADER (executor), MARKETMAKER (downloader)
Related: KAZUAR, WILDDAY, DIAMONDBACK (co-deployed Turla tooling)
Obfusc.: K1MORPHER (K1.Morpher, Squirrel3 PRNG strings)
Lib:     websocket-sharp.dll
         d1e54270433a94aa3d45d888e4c62299bee3480eb2cb4a5489c7dda69d476c3e

[ ] WinRAR >= 7.13 fleet-wide (CVE-2025-8088 fixed)
[ ] Mail gateway strips/quarantines .rdp and .hta attachments
[ ] Mail gateway inspects .rar for bundled .lnk/.exe
[ ] Proxy denies wss to *.onrender.com / *.glitch.me (or alert)
[ ] ASR: block executable content from email/webmail (enforce)
[ ] WDAC/AppLocker blocks unsigned EXEs in %LOCALAPPDATA%\Programs
[ ] mshta.exe execution blocked or alerted (rarely needed)

• Telemetry ready: Confirm ProcessRollup2, AsepValueUpdate/RegGenericValueUpdate, DnsRequest, and PeFileWritten are flowing from in-scope Windows hosts.
• Benign baseline: Run Q5 (PaaS WebSocket) and Q6/Q7 (delivery) over 7–14 days; record benign developer hosts and saved-.rdp admin workflows for tuning before alerting.
• Positive test: In a lab, create a Run-key referencing a file in a Programs\SMN folder and resolve a benign name on *.onrender.com — confirm Q2 and Q5 fire.
• Promotion: Only promote Q1/Q2/Q9 to detect/block after zero benign hits across the baseline window.

P1 · Inventory WinRAR versions (flag < 7.13)

Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*' |
  Get-ItemProperty | Where-Object { $_.DisplayName -like 'WinRAR*' } |
  Select-Object DisplayName, DisplayVersion |
  ForEach-Object {
    $vuln = $false
    if ([version]($_.DisplayVersion) -lt [version]'7.13') { $vuln = $true }
    [pscustomobject]@{ Name=$_.DisplayName; Version=$_.DisplayVersion; Vulnerable=$vuln }
  }

P2 · Audit Run-key persistence referencing user paths / SMN

$paths = @(
  'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
  'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
)
foreach ($p in $paths) {
  if (Test-Path $p) {
    (Get-ItemProperty $p).PSObject.Properties |
      Where-Object { $_.Value -match 'Programs\\SMN|StockMarket|SMNet|MSViewer|MSDriver|MSRender' } |
      Select-Object Name, Value
  }
}

P3 · ASR — block executable content from email/webmail (enforce)

Add-MpPreference -AttackSurfaceReductionRules_Ids `
  BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 -AttackSurfaceReductionRules_Actions Enabled
# Verify:
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids

P4 · Block unsigned EXEs under per-user Programs (WDAC concept / AppLocker rule)

<!-- Deny execution from %LOCALAPPDATA%\Programs, the STOCKSTAY install path. -->
<!-- Import: Group Policy -> Computer Configuration -> Windows Settings -> Security
     Settings -> Application Control Policies -> AppLocker -> Executable Rules -->
<!-- SHIPS AS AuditOnly ON PURPOSE. Run it for at least a week and review EventID
     8003 before flipping EnforcementMode to "Enabled". -->
<RuleCollection Type="Exe" EnforcementMode="AuditOnly">
  <!-- Microsoft default allow rules -- DO NOT REMOVE. Without them, enforcing this
       collection blocks every executable on the machine, including your RMM agent. -->
  <FilePathRule Id="921cc481-6e17-4653-8f75-050b80acca20" Name="(Default) All files in Program Files"
                Description="Allows Everyone to run applications in Program Files."
                UserOrGroupSid="S-1-1-0" Action="Allow">
    <Conditions><FilePathCondition Path="%PROGRAMFILES%\*" /></Conditions>
  </FilePathRule>
  <FilePathRule Id="a61c8b2c-a319-4cd0-9690-d2177cad7b51" Name="(Default) All files in Windows"
                Description="Allows Everyone to run applications in the Windows folder."
                UserOrGroupSid="S-1-1-0" Action="Allow">
    <Conditions><FilePathCondition Path="%WINDIR%\*" /></Conditions>
  </FilePathRule>
  <FilePathRule Id="fd686d83-a829-4351-8ff4-27c7de5755d2" Name="(Default) All files -- Administrators"
                Description="Allows local Administrators to run all applications."
                UserOrGroupSid="S-1-5-32-544" Action="Allow">
    <Conditions><FilePathCondition Path="*" /></Conditions>
  </FilePathRule>

  <!-- A path rule cannot express 'unsigned' -- the original text asked for that and AppLocker path rules cannot do it. This denies the PATH. Teams, Slack, VS Code, Zoom and most self-updating agents install here, so audit for a full 14 days and add FilePublisherCondition allow rules for the signed apps you keep. -->
  <FilePathRule Id="3fa77b26-8e51-4c09-a7d2-6b18e4f0c9a3" Name="Deny LocalAppData\Programs execution for standard users"
                Description="STOCKSTAY / Turla installs to the per-user Programs directory"
                UserOrGroupSid="S-1-5-32-545" Action="Deny">
    <Conditions>
      <FilePathCondition Path="%OSDRIVE%\Users\*\AppData\Local\Programs\*" />
    </Conditions>
  </FilePathRule>
</RuleCollection>

Prerequisites: the Application Identity service (AppIDSvc) must be Running/Automatic, set via GPO -- AppLocker evaluates nothing without it. Pilot OU. Reboot required: no (gpupdate /force to refresh policy).

Verify: during the AuditOnly week, review Applications and Services Logs > Microsoft > Windows > AppLocker > EXE and DLL for EventID 8003 (would-have-blocked). Zero unexpected entries means it is safe to set EnforcementMode="Enabled"; a real block then logs EventID 8004.

Rollback: set EnforcementMode="NotConfigured" and re-import, or unlink the GPO and run gpupdate /force. If a host is already locked out by an over-broad policy, boot to Safe Mode (AppLocker does not enforce there) and stop AppIDSvc, or delete %WINDIR%\System32\AppLocker\*.AppLocker.

Detection is strongest at masquerade-name, install-path, persistence, and atomic-hash layers (all low-FP). C2 hosts are high-fidelity but perishable; behavioral PaaS-WebSocket and delivery hunts need environment tuning. In-implant collection commands and mail delivery are gaps best covered upstream (mail gateway, §7 native hunts) rather than EDR.