Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

STOCKSTAY Another Day: The Latest Addition to Turla’s Intelligence Gathering Apparatus Written by: Jordan Jones Introduction Google Threat Intelligence Group (GTIG) has conducted an in-depth analysis of a .NET backdoor, tracked as STOCKSTAY, that has been continually developed and deployed by the Russia-linked threat actor Turla (aka SUMMIT, Secret Blizzard, VENOMOUS BEAR, UAC-0194) since at least December 2022. Turla has deployed STOCKSTAY against government and military or…

https://cloud.google.com/blog/topics/threat-intelligence/stockstay-turla-intelligence-gathering

sha256:ea714a3a0ae2af7e20a0c029c73f4ebca5504fb5671939190901bd2832d031c0

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve1
md50
url5
ipv41
ipv65
sha10
domain76
sha25651
malware_token0
attack_pattern0
threat_actor_token1

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
domain	wscript.shell	Open →
cve	CVE-2025-8088	Open →
sha256	391e51354118fb87dc57650cbbd94258c3f7c0a0d6868040b7a473ad626ff25e	Open →
sha256	0a545dd1b703cddfb3d582c8c70f65f556bbd580bfa836a387121eb837bda61b	Open →
sha256	0d6b083208097d5b3e189891338540f6c64faaaaf268b0bb0b085dd53d5857b4	Open →
sha256	1682e8d82016b3f10434d2ebac995fd3b6aa812f079bfd7888652e94a994d851	Open →

Malware families

Allowlist token matches only.

None extracted.

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

Turla

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports