Russian‑Linked Turla Backdoor Targeting Ukraine Exposes New Government Cyber Vulnerability
Google has tied Russia‑linked Turla to a new .NET backdoor, STOCKSTAY, used in espionage campaigns against Ukrainian government and military targets. The operation exploited phishing, booby‑trapped installers and a WinRAR flaw, underscoring how Ukraine’s state systems—and anyone sharing data with them—remain in a high‑end cyber crosshairs.
Ukraine’s war is being fought not just with drones and missiles, but through carefully crafted email lures and malicious software buried deep in government networks. Google researchers have linked the Russia‑associated hacking group Turla to a new .NET‑based backdoor, dubbed STOCKSTAY, that has been used in espionage operations against Ukrainian government agencies and military organizations.
According to the technical details released, the campaign relied on a familiar but potent mix of tools: phishing emails to trick users into opening payloads, malicious Remote Desktop Protocol files, booby‑trapped MSI installers, and exploits for a WinRAR vulnerability tracked as CVE‑2025‑8088. Once installed on a victim machine, STOCKSTAY provides persistent access, allowing operators to exfiltrate documents, credentials and communications, and potentially to pivot deeper into sensitive networks.
For the Ukrainian officials and officers targeted, the stakes are personal and operational. A compromised email account can expose contact networks and negotiation lines; a hacked workstation in a planning office can reveal troop movements, supply challenges or defensive weaknesses; surveillance of internal chats can give adversaries a window into morale and political debates. Even when no sabotage is attempted, the quiet theft of information can shape Russian military and diplomatic decisions in ways that put Ukrainian units and cities at greater risk.
The threat does not stop at Ukraine’s borders. Government agencies, NGOs and private contractors in Europe and North America that exchange files with Ukrainian partners may be handling documents touched by compromised systems. That creates a channel for lateral movement, in which Turla or similar actors could leverage trust relationships to push deeper into NATO‑country networks. In a conflict where intelligence on arms deliveries, sanctions implementation and diplomatic strategy is highly prized, that possibility is not theoretical.
Strategically, STOCKSTAY fits Turla’s profile as a long‑running espionage actor aligned with Russian state interests, known for stealth rather than smash‑and‑grab disruptions. The group’s willingness to build a new backdoor around a recent WinRAR flaw shows how quickly advanced teams weaponize publicly disclosed vulnerabilities, and how important timely patching and configuration are for frontline states like Ukraine. Every unpatched machine becomes a potential listening post for adversaries trying to stay ahead of battlefield and political shifts.
The campaign also illustrates the asymmetry of cyber conflict. Developing and deploying a bespoke backdoor and phishing infrastructure costs a fraction of what a single artillery barrage does, yet can yield information that shapes entire operations. For defenders, the cost is ongoing: constant monitoring, user training, incident response, and sometimes the painful decision to rebuild systems from scratch after a breach.
The core lesson is that in a war where artillery lines are relatively static, the most dynamic advances are happening in invisible code. A single successful phishing click in a ministry office can matter as much as a reconnaissance drone flight over the front.
Signals to watch next include whether Ukrainian and allied cyber authorities publish indicators of compromise that show the scale of STOCKSTAY’s spread, whether similar campaigns are detected against other front‑line states or NATO institutions, and how quickly organizations close the WinRAR vulnerability and tighten controls around RDP and software installers. Any reports of the backdoor being linked to operational leaks or disrupted Ukrainian plans would mark a sharper escalation from espionage into direct battlefield impact.
Sources
- OSINT