Google Threat Intelligence Group has attributed a previously undocumented .NET backdoor, ‘STOCKSTAY,’ to the Russian state-sponsored threat actor Turla. This backdoor has been deployed against government and military organizations in Ukraine, as well as entities interested in Italian foreign policy. The continuous development of STOCKSTAY indicates Turla’s ongoing espionage efforts.