STOCKSTAY Backdoor Targets Ukraine with Malicious RDP Files and WinRAR Exploit
Key Takeaways A new cyber-espionage campaign is deploying the STOCKSTAY backdoor against targets in Ukraine. The attackers, linked to the Russian state-sponsored Turla group, are leveraging malicious...
Key Takeaways
- A new cyber-espionage campaign is deploying the STOCKSTAY backdoor against targets in Ukraine.
- The attackers, linked to the Russian state-sponsored Turla group, are leveraging malicious Remote Desktop Protocol (RDP) files and a recently patched WinRAR vulnerability (CVE-2025-8088).
- STOCKSTAY employs a modular design, mimics legitimate software, and utilizes sophisticated command-and-control (C2) evasion techniques, including legitimate cloud platforms and a “dead drop” mailbox system.
- The backdoor establishes persistence by dropping shortcut files into the Windows startup folder, ensuring it restarts with the system.
- Organizations, particularly those in Ukraine, should prioritize patching WinRAR, enhancing user awareness, and monitoring outbound network traffic to detect and mitigate this threat.
A sophisticated cyber-espionage operation, recently brought to light, is actively deploying a stealthy backdoor identified as STOCKSTAY on computer systems within Ukraine. This campaign exploits deceptive Remote Desktop Protocol (RDP) files and a recently addressed vulnerability in WinRAR to achieve its objectives.
Table Of Content
The STOCKSTAY malware is designed to evade detection by masquerading as benign applications, such as stock market monitoring tools and calculator utilities. This tactic allows it to operate discreetly while systematically gathering sensitive intelligence from compromised machines.
Constructed in .NET, STOCKSTAY features a modular architecture comprising distinct components, each responsible for specific functions like command and control (C2) communications, file exfiltration, and command execution. This design offers attackers significant flexibility, enabling them to modify or replace individual modules without redeveloping the entire malware, thereby complicating defensive efforts and analysis.
Attribution to Turla APT Group
Security researchers at Picus Security have been closely monitoring this activity, linking it to the notorious threat group known as Turla, also referred to as Secret Blizzard. Picus Security said in a report, this group has a long history of espionage operations, dating back to 2004, and is widely believed to be affiliated with Russia’s Federal Security Service (FSB), making it one of the most enduring state-sponsored hacking entities globally.
Recent campaigns by Turla have increasingly focused on social engineering tactics, compelling victims to open malicious files rather than relying solely on complex zero-day exploits.
Exploiting RDP Files and WinRAR Vulnerability
In one observed incident, a compromised university email account was used to distribute a malicious RDP configuration file. This file, disguised as an invitation to a distance learning trial, silently initiated an outbound connection to attacker-controlled servers upon execution, facilitating further payload delivery.
Additionally, the group has weaponized a WinRAR path traversal vulnerability, tracked as CVE-2025-8088. This flaw allows attackers to embed STOCKSTAY components directly into a victim’s startup folder when a specially crafted RAR archive is extracted. These malicious archives are often disguised as legitimate tools, such as a military pay calculator.
The backdoor achieves persistence through shortcut files, such as MSViewer.lnk and MSDriver.lnk, which are placed in the Windows startup directory. These shortcuts, bearing innocuous names, ensure that STOCKSTAY automatically launches each time the compromised system boots, providing a resilient foothold against simple reboots or basic cleanup attempts.
Advanced Evasion Techniques
STOCKSTAY employs sophisticated methods to conceal its command and control traffic. Instead of direct communication with a dedicated C2 server, the malware routes its traffic through legitimate cloud platforms, including serverless hosting services and browser application platforms. This technique allows malicious communications to blend seamlessly with normal web traffic, making detection challenging for network defenders.
The malware also utilizes a “dead drop mailbox” mechanism, where infected machines and the attackers’ operators interact with a shared relay for message exchange, rather than establishing direct connections. This further obfuscates the C2 infrastructure, making it difficult for security teams to trace the communication path between victims and controllers. To add another layer of stealth, STOCKSTAY encrypts its configuration data using a hash derived from the victim’s hostname, meaning a captured sample cannot be easily analyzed in a generic sandbox environment without the specific decryption key tied to the target system.
Given these advanced evasion tactics, security organizations are advised to move beyond traditional signature-based detection and implement proactive defense strategies. Simulating known Turla attack patterns can help identify vulnerabilities in existing security postures before a real breach occurs. Furthermore, rigorous monitoring of outbound network connections to unfamiliar cloud hosting services is a crucial first step for network defenders.
Considering Turla’s propensity for disguising its tools as everyday utilities and embedding its traffic within trusted platforms, comprehensive user awareness training concerning unexpected RDP files and unsolicited archive attachments remains a fundamental defense mechanism. Regular updates of WinRAR and other archiving software are also essential to patch known vulnerabilities and close potential entry points exploited in these attacks.
What You Should Do
- Patch WinRAR Immediately: Ensure all instances of WinRAR are updated to versions that address CVE-2025-8088 to prevent exploitation of the path traversal vulnerability.
- Educate Users: Conduct awareness training on the dangers of opening unsolicited RDP files and extracting suspicious archive attachments, even if they appear to come from trusted sources.
- Monitor Network Traffic: Implement robust network monitoring to detect unusual outbound connections, especially to unfamiliar cloud hosting services or dynamic DNS domains.
- Review Startup Folders: Regularly audit Windows startup folders for suspicious shortcut files (e.g., .lnk files) that could indicate persistence mechanisms.
- Implement Endpoint Detection and Response (EDR): Utilize EDR solutions to detect and respond to suspicious process activity and file modifications characteristic of STOCKSTAY.
- Threat Emulation: Perform threat emulation exercises simulating Turla’s TTPs to evaluate and improve the effectiveness of existing security controls.
Indicators of Compromise (IoCs):-
No Comment! Be the first one.