Google links Turla to STOCKSTAY, a new .NET backdoor used in phishing attacks against Ukraine government and military targets ...
Russia-linked APT Turla has been using the StockStay backdoor against government and military organizations in Ukraine.