The Latest Addition to Turla’s Intelligence Gathering Apparatus
Written by: Jordan Jones
Introduction
Google Threat Intelligence Group (GTIG) has conducted an in-depth analysis of a .NET backdoor, tracked as STOCKSTAY, that has been continually developed and deployed by the Russia-linked threat actor Turla (aka SUMMIT, Secret Blizzard, VENOMOUS BEAR, UAC-0194) since at least December 2022. Turla has deployed STOCKSTAY against government and military organizations in Ukraine, as well as entities with an interest in Italian foreign policy. Used for ongoing cyber espionage, this backdoor shares significant code and functional overlaps with KAZUAR, a successful toolkit previously attributed to Turla. The group has a long history of targeting a wide range of industries, with a particular focus on western Ministries of Foreign Affairs, and defense organizations within the context of heightened political tensions.
Turla, and specifically their longstanding Snake implant, has been publicly attributedby the United States Cybersecurity and Infrastructure Security Agency (CISA) to Center 16 of Russia’s...
Copyright of this story solely belongs to google.com. To see the full text click HERE
