STOCKSTAY: the espionage system that learned to divide its work

1 One task connects three processes to one delivery chain

Google Threat Intelligence Group's June 26, 2026 disclosure provides a finding that can be turned directly into an incident-response task. The .NET espionage system assigns remote transport, task coordination, and host operations to separate processes. Filenames moved from stock-market software to PDF viewers, calculators, drivers, and renderers while the internal net, cor, and sys duties persisted. A file digest may locate the first artifact. Full containment must cover the three roles in the same user session, their configuration, persistence, delivery object, and external connection.

After any role is confirmed, the default action is to isolate the device from untrusted networks while preserving configuration, infection UUIDs, window messages, and key material that may remain in memory. The case team then inventories every executable, DLL, configuration, LNK, MSI, RAR, ZIP, HTA, and RDP object from the same directory, session, installer, or persistence source. Loss of the process that owns the WebSocket shows that the current transport stopped. Device trust returns only after the complete role set, original entrance, identity impact, and host effects each have a disposition.

1.1 Walk through one observable task before learning the names

A file-collection task exposes the design. A delivery object installs three roles and a configuration. The coordinating process reads that configuration and learns the remote service and operating schedule. The worker receives an instruction, enumerates and reads selected files, and prepares a result in memory. The network helper maintains a secure external connection and sends the result through the /ws path. Hidden-window messages hand the task between local processes, so file access and network transmission usually belong to different process identities.

That path creates four sets of directly searchable joins. Delivery evidence shows how mail, an RDP session, an HTA, an installer, or an exploited archive brought bytes to the device. Local-assembly evidence shows whether three managed processes came from one directory, logon session, installer, or Startup/Run source. Task evidence identifies the process that enumerated files, queried WMI, captured the screen, changed the registry, or launched a hidden child and the nearby process that coordinated it. Egress evidence identifies the process that owned DNS, proxy, TLS, and WebSocket activity and asks whether its hostname, /ws path, schedule, and byte changes align with the host effect.

An incident statement ends at the last proven transition. Mail delivery establishes targeting; an attachment open or remote-image request establishes interaction; malicious bytes on disk establish delivery; process start establishes execution; three roles and local communication establish system assembly; a WebSocket carrying tasking or response data establishes remote operation; and file, screenshot, registry, WMI, or child-process telemetry establishes a specific host effect. This order prevents twenty recipients from becoming twenty compromised hosts and prevents a disabled cloud service from hiding resident components that remain on disk.

1.2 cor coordinates, sys changes the host, and net carries external traffic

cor is STOCKMARKET, the orchestrator. It decrypts the disguised on-disk configuration, manages infection identity, scheduling, and service information, and routes tasks to the other roles. sys is STOCKTRADER, the worker that produces host effects. net is STOCKBROKER, a proxy-aware transport process that owns the secure WebSocket. MARKETMAKER belongs to the delivery layer: it downloads, extracts, and establishes persistence for the resident set.

This division determines the unit of hunting and containment. A hunt based only on network ownership misses sys. A hunt based only on files and WMI misses net. Terminating one process leaves the remaining roles and their reconstruction materials. Durable family identification follows the relationship: managed processes in the same session, package, or persistence source, with one process owning external transport, one coordinating, and one producing effects that fit the published command families.

2 Local messages and the remote queue complete the same task

The terminology becomes useful after the task path is clear. IPC means communication among processes on one host. STOCKSTAY uses Windows Forms to create windows that do not present a normal user interface and exchanges Windows messages among its roles. C2 means the remote command-and-control path. Only net connects directly to the secure WebSocket; cor and sys enter that path through local messages. Environmental keying means that configuration decryption depends on a target hostname, domain, username, or known secret, so a file can remain opaque outside its intended environment.

2.1 Hidden windows carry local handoffs and configuration selects the environment

Microsoft defines WM_COPYDATA as message 0x004A. A sending process uses SendMessage to pass a COPYDATASTRUCT containing an application-defined value, byte length, and data pointer synchronously to the receiving window. A receiver that needs the content after processing returns must copy it into a local buffer. This ordinary Windows feature becomes STOCKSTAY evidence through role identity, window names, user session, content shape, and nearby effects.

GTIG's public rules include SMEditorPage, SMNetPage, StockMarketViewPage, and several window_system32_* names. The broker rule joins wmCopyData, tempStorage, WebSocket state, and protocol methods. Static strings locate candidates. Live window ownership, same-session roles, and synchronized host effects elevate possible code to observed local handoff. When an endpoint product does not record SendMessage, the case should preserve that gap and use memory, live window enumeration, process timing, and effect correlation as supporting evidence.

The outer configuration JSON pretends to describe a stock-market application. It lists legitimate exchange WebSocket endpoints and hides encrypted operational fields in SystemConfiguration. Public reporting gives those exchange URLs no malicious relay role. Decrypted fields include internal_id, internal_key labeled as the server public key, service address, pacing, operating hours, days off, and system properties. Most analyzed configurations used 09:00–18:00 on weekdays in local host time. That cadence guides historical search; activity outside it remains in scope.

Different delivery stages used different passwords. The 2023 combined sample used the intended host's lower-cased hostname. A replacement configuration in the established Ukrainian intrusion decrypted with the target domain. The April 2025 initial-access package used a hard-coded password. A failed sandbox decryption therefore has to return to the original endpoint context. Before rebuilding or renaming a host, preserve exact hostname, domain, username, casing, locale, encoding, configuration bytes, and every tested input. A successful input explains the file under examination and does not define every branch.

On first execution, cor also generates an infection UUID and a unique 4096-bit RSA key pair. The UUID participates in remote routing; the configured internal_id identifies a server-side route. A dashboard must retain them as separate fields. GTIG reports that the client sends its public key in the first request and uses the pair through the implant lifecycle to protect outbound data. Public evidence omits complete modes, padding, storage decisions, and call paths. The affected build and acquired memory have to support any claim about key recovery; framework defaults cannot fill the gap.

2.2 The /ws relay stores routing relationships while message bodies remain encrypted

The victim-facing controller described by GTIG consisted of server.py, models.py, and wtools.py. server.py extends Tornado's WebSocketHandler at /ws. check_origin accepts all origins, open and on_close log client addresses, and on_message decodes the Base64 outer layer and processes a JSON package. Base64 provides text framing. The client-side CryptoContainer protects the task body.

A send action writes target, sender, and encrypted message into SQLite. The weather_data table calls recipient degrees, sender pressure, body wdata, and stores an address in coords with creation time. status defaults to zero; GTIG's public code description says it does not appear to be used or returned to the client. A recv action selects rows for the receiving identity, returns target, sender, message, IP, and time, and then deletes them. A second log table stores a message and timestamp.

This queue hides content while preserving connection, routing, and timing evidence. A provider may retain account registration, repository links, build and deployment history, environment changes, edge requests, service deletion, and billing data. Application and database material may retain UUIDs, addresses, creation, and retrieval times. SQLite deletion changes the logical view first; the main database, WAL, journal, snapshots, or backups may retain pages. Acquisition must copy the database and companions consistently and avoid opening originals with a tool that can write or checkpoint.

An address from X-Forwarded-For needs comparison with provider-edge behavior and organization proxy records before it is mapped to a device. A successful WebSocket upgrade establishes transport. Queue direction still requires separation of infection UUID, server-side internal_id, submitter, and retriever. File reads and in-memory compression before encrypted traffic support a result consistent with collection. Endpoint content, frame relationships, or provider retrieval evidence is needed for confirmation.

3 Observable relationships determine whether a lead becomes an incident

STOCKSTAY's durable surface is a set of relationships. An investigation can enter through a known digest, YARA result, or network indicator, then it must show how a delivery object installed the roles, whether the three roles cooperated in one session, which process produced the effect, which carried the result out, and whether the original entrance can deploy them again. The following table is the article's single authoritative identity-and-action map. Later sections explain its evidence without reshuffling the role order.

3.1 Strong evidence joins the same task across independent sensors

The highest local evidence grade joins task receipt, an exact host effect, result construction, and net transport through a shared identifier, content, or clear sequence. The next grade connects a role process and effect through strong context but lacks encrypted message or IPC content. A known sample or full method-cluster hit with no execution record establishes code identity. Mail themes, scanning-service geography, isolated cloud addresses, and ordinary library overlap remain scoping leads that need host evidence.

Detection should expand both directions from any strong node. A net finding triggers searches for same-session managed processes, hidden windows, configuration, Run/Startup, and sys effects. A sys finding triggers a search for its coordinator, WebSocket owner, affected files, and user. A configuration finding triggers a search for the parent container, environment inputs, service address, and exact roles. A delivery finding follows the installation tree, persistence, and first execution into all three roles. Each detector should hand the next query to the responder.

Legitimate software also uses websocket-sharp, Windows Forms, SQLite, managed AES/RSA, WMI, Run keys, Squirrel3, and WM_COPYDATA. Production correlation therefore requires convergence across role, path, process relationship, configuration, and effect. Approved .NET WebSocket clients, WMI inventory tools, signed installers that write Run keys, and ordinary screen-sharing tools provide negative controls that verify a common behavior alone cannot trigger the strongest action.

The common 09:00–18:00 weekday cadence helps order a hunt. Correlation windows still need local calibration from observed task delay. A screenshot can be followed quickly by a response, while recursive file selection and in-memory compression can take much longer. A fixed five-second join will miss work; a full-day join can bind unrelated applications. Preserve the original event sequence and calibrate by command family and configuration schedule.

3.2 Family classification records identity, role, and provenance together

An exact digest can confirm a known object, and a complete role chain can confirm the running system. Strong handler and package evidence without execution supports a probable family relationship. Shared libraries or obfuscators remain related material. Infrastructure or lure matches stay campaign leads. This grading lets every artifact carry only the claim its evidence supports.

Provenance changes meaning as well. A scanning-service file establishes availability by submission time. A public repository establishes development or staging material. A compromised-site log can establish downstream retrieval. Mail telemetry can establish receipt or opening. Endpoint and incident-response records establish execution, effects, and local scope. Uploads from Germany, the Netherlands, Italy, or Poland do not automatically create victims in those countries.

Each classification retains file and parent-container hashes, signer, assembly and module identity, method token or IL offset, configuration derivation, package membership, role, source, date, and confidence. The externally modularized November 2025 branch especially depends on package membership. A DLL found alone can be residue, and an EXE found alone can lack the implementation that defined its role.

4 Verified delivery routes converge when the role set assembles

The public record includes RDP, HTA, MSI, compromised websites, and RAR archives exploiting a WinRAR flaw. Each route has a different entrance. It joins the STOCKSTAY case only when evidence reaches role assembly. Themes, countries, and platforms provide search starting points; endpoint transitions establish the incident stage.

4.1 RDP and HTA used MARKETMAKER to install the three roles

On April 2, 2025, GTIG observed a compromised Ukrainian university mailbox send a distance-learning lure. The attached RDP file connected a device to TCP 3389 on an actor-registered lookalike domain. GTIG then saw the actor place MARKETMAKER on the client. The downloader retrieved docs.zip from a compromised website belonging to the State Regulatory Service of Ukraine. The archive contained all three roles and a fonts configuration pointing to wss://weatherdataai.theworkpc.com/ws. The compromised mailbox, deceptive RDP host, compromised download site, and C2 service are four separate owner, preservation, and repair objects.

The RDP path is proven one transition at a time: receipt, open, mstsc.exe start, destination resolution, TCP connection, certificate and authentication interaction, usable remote session, resource redirection, MARKETMAKER transfer, and execution. GTIG's follow-on visibility carries the April case to installation. A local case with a matching attachment and a blocked connection stops at interaction and unsuccessful delivery, while still justifying containment and scoping.

The calculator operation used a Ukrainian-language HTA in a RAR archive. Its JScript renamed styles.dat to styles.dat.exe and launched a MARKETMAKER variant. The downloader fetched EditorToolsPdf.zip from another compromised Ukrainian WordPress server. ViewPdf.exe, ClientMNGR.exe, ConverterDDSNet.exe, and fonts mapped to coordination, transport, host operation, and configuration. The HTA swallowed exceptions, so a user-visible absence of errors cannot establish failed execution. Search for the source and renamed path, file identifier, mshta.exe, COM activity, child process, second-stage request, extraction, and role starts.

The 2024 Copia.msi shows why the installer itself belongs in evidence. It mixed STOCKSTAY with benign ILSpy files under %LOCALAPPDATA%/Programs/SMN/, established Run persistence, and used the first user-interface sequence action to open an Italian-language foreign-affairs lure. GTIG did not confirm an Italian-election target; the public evidence supports suspected interest in foreign-affairs audiences. MSI tables, custom actions, embedded binaries, install logs, configuration, and persistence order should stay together.

4.2 The November 2025 RAR route placed modular roles into Startup

On November 6, 2025, an actor used a drone-themed UKR.NET account to send unique file-sharing links to roughly twenty Ukrainian targets and continued on November 12 and 14. Each link led to a malicious RAR exploiting CVE-2025-8088 and attempting to write shortcuts into Startup outside the directory selected by the user. GTIG observed about thirty percent of recipients open the mail and could not confirm download or execution counts. Receipt, opening, download, extraction escape, Startup placement, logon launch, role assembly, and WebSocket session must retain separate denominators.

The proof object for this route is the WinRAR executable or library that processed the archive, along with version and signature, extraction root, entry names, resolved output paths, file creation, LNK target, and next logon. A write outside the extraction root supports exploitation behavior; shortcut target and later role process support persistence and execution. The NVD record places versions through 7.12 in the affected range and 7.13 at the repair boundary. A software-inventory row cannot represent portable and embedded copies that remain on disk.

The November branch externalized shared behavior. MSViewer.exe, MSDriver.exe, and MSRender.exe carried cor, net, and sys, while neighboring DLLs held cryptography and obfuscation, IPC, and command processing. Most samples used wss://driverx86-adobe.onrender.com/ws; at least one used wss://google-ai-labs-it.onrender.com/ws, whose service name matched the August controller repository. Configuration presence, DNS resolution, TLS connection, WebSocket upgrade, and task effect remain separate stages.

External-image requests in the lure documents can establish that a device or automated scanner fetched a resource. They cannot establish RAR payload execution alone. User agent, source network, request time, mail-security prefetch, document process, and endpoint effects distinguish the source. A unique link can join mail to a request when service logs survive, but endpoint evidence is still needed to identify the user-driven stage.

4.3 One confirmed host and one compromised domain create different scope

The late-2023 Ukrainian incident provides the strongest operational context. Turla controlled a domain controller and used malicious Group Policy to deploy WILDDAY, DIAMONDBACK, KAZUAR, scripts, and other backdoors. GTIG later confirmed STOCKSTAY execution on one host affected by that controller. The public family-execution claim covers that host. The compromised domain controller, Group Policy, and staging evidence show a failed administrative trust boundary, so identity, managed-host, and redeployment scoping must expand across the environment. Both scopes belong in the ticket.

An initial configuration in that case would not decrypt with known values. A replacement decrypted with the target domain and exposed wss://wool-basalt-clock.glitch.me/ws plus the weekday schedule. The first object may belong to another environment, be a default, be corrupt, or be deliberately invalid; the public record does not choose among those explanations. Preserve both originals, arrival order, hashes, and tested inputs. The working second file cannot supply a purpose for the first.

A compromised website also creates two scopes. One incident record follows downstream STOCKSTAY delivery: exact object path, content hash, request population, and removal time. Another follows the legitimate server compromise: credentials, vulnerable components, web shells, accounts, logs, and additional payloads. GTIG establishes abuse of several Ukrainian services and does not publish every root cause. The site owner should repair the entrance proven by local evidence.

5 Host effects set the highest supportable exposure finding

The published sys capability covers files and directories, registry, process execution, screenshot, WMI survey, and ZIP extraction. The command dictionary represents capability and cannot be relabeled as execution. Each impact needs evidence of task arrival, system action, result construction, local handoff, and net transmission. The conclusion ends at the last confirmed stage.

5.1 Files, screens, system survey, and child processes leave different residue

Dir enumerates paths. Get can select by file, directory, and extension, build an in-memory ZIP, and encode it for return. No archive file has to appear on disk. Broad metadata access, concentrated reads, compression calls, memory growth, and a later net byte increase can still expose the sequence. Exposure language should distinguish names seen, content read, content compressed, response placed into the return path, bytes confirmed beyond the organization, and provider-confirmed retrieval. Every higher stage requires a new join.

Put uses append writes, so several tasks can assemble one final file. Preserve destination, file identifier, offsets, sizes, intermediate state, and final hash, then ask whether Run or UnpackArchive consumed it. Run waits sixty seconds by default, hides the window, and redirects standard output. A child can outlive the wait or create descendants. Exact command line, working directory, token, signer, modules, network, output pipe, exit status, and descendant tree define the follow-on scope.

Image captures the active desktop and can include chat, remote administration, documents, one-time codes, or visible credentials even when sys never reads the underlying file. Without a recovered image, the case can identify the user, session, active desktop, monitor layout, lock state, and foreground windows that may have been visible; it cannot claim exact pixels. Sysinfo uses WMI to gather operating system, hardware, language, user, disk, and process data. The original field set and initiating process carry more evidentiary value than a normalized dashboard statement that “WMI occurred.”

MultyTask submits several tasks in sequence and discards output, so multiple host effects can accompany a quiet return channel. Group registry, file, process, and extraction events under the cor and local-message interval; response-body count provides no reliable boundary. Delete operations also require separation of request, attempt, success, and residual recovery. A missing file with no earlier inventory cannot be attributed automatically to malware deletion.

5.2 Encryption limits content confirmation while endpoint and provider evidence can establish direction

The encrypted object transmitted by net conceals content. Endpoint telemetry can still show paths read by sys, in-memory archive preparation, cor coordination time, and net byte movement. Provider records of submission and retrieval, UUIDs, deployments, and database material can add direction. Size similarity without identifiers and timing supports language such as “consistent with a collection response.” Endpoint content, a frame relationship, or queue retrieval is needed to confirm transfer.

Screenshots, undecryptable configurations, and arbitrary child processes expand uncertainty. Legal, notification, and recovery teams need an impact record organized by evidence stage. Each row should name the object, host, user session, task interval, evidence source, last confirmed stage, and missing evidence. Later provider or backup evidence then upgrades the specific row without rewriting the whole incident.

Public victim scope is governed by the same discipline. GTIG has strong observations concerning Ukrainian government and military targeting and material concerning at least one European foreign-affairs interest. Early uploads from Germany, the Netherlands, Italy, and Poland may represent development, operators, security products, or researchers. The approximately twenty November recipients and roughly thirty-percent open rate describe the mail stage; download and execution remain unknown. Every number retains its original denominator.

GTIG links the STOCKSTAY ecosystem and related activity to Turla with high confidence, assesses partial shared development with KAZUAR at moderate confidence, and discusses a fallback purpose at low confidence. Confirmed roles, persistence, compromised access, and host effects trigger isolation, preservation, and rebuild. Attribution separately guides strategic risk and intelligence sharing.

6 Response preserves relationships, interrupts precise routes, and restores trust

The incident lead replaces separate mail, endpoint, network, identity, and provider alert summaries with one shared task record. The task record centers on device and logon session and joins the original delivery object, install tree, roles and modules, configuration, persistence, local message, host effect, WebSocket, and provider object. Each edge carries its source, clock, evidence link, owner, and current confidence.

6.1 Preservation order follows volatility and human safety

First record and test isolation across every egress path. Then acquire memory, process, window, module, handle, and network ownership evidence when safe. Encrypted configuration and environment values, infection UUID, public-key material, local-message buffers, and in-memory archives can disappear when processes terminate. When operational risk requires an immediate stop, record the tradeoff and the evidence lost. Do not keep a confirmed infected device on the production network to await another callback.

The mail team preserves MIME, authentication, links, attachments, Zone.Identifier, and click or open evidence. Endpoint teams preserve containers, directory trees, roles, configuration, persistence, memory, and effects. Network teams preserve DNS, proxy resolution, CONNECT, TLS, WebSocket, byte counts, and reconnects. Identity teams preserve remote sessions, tokens, mailbox rules, and privileged use. A provider request names the exact account, repository, service, deployment, hostname, /ws path, UTC range, and three Python-file digests.

Every important edge needs a relationship key beyond time, such as one user session, parent container, shared directory, UUID, configuration, window identifier, parent-child process, task size, or platform deployment record. Preserve original system timestamps, time zones, and acquisition times, then calibrate a derived timeline. If proximity is the only remaining link, label it as pending; establishment requires another relationship key.

6.2 Before removing roles, determine how they can return

The eradication inventory covers MARKETMAKER, cor/net/sys, external DLLs, configuration, Run, Startup, staging archives, MSI packages, and runnable copies in deployment shares or backups. Preserve forensic copies before deletion. If the roles came through an RDP transfer, HTA download, WinRAR path traversal, MSI, malicious Group Policy, or compromised website, repair that route in the same incident. Otherwise a rebuilt host can receive the components again from an untrusted management or delivery surface.

A domain-controller case restores administrative tiers, Group Policy, replication, remote management, and secrets before rebuilding affected endpoints. A compromised mailbox requires session and OAuth revocation, forwarding-rule review, recovery-path repair, and credential rotation. A compromised website is imaged and reviewed for accounts, web shells, persistence, and additional payloads before the proven entrance is repaired. A hosting provider preserves account and deployment evidence before suspending or remediating the exact malicious service. Organization-side behavior hunting continues because the actor can rename its infrastructure.

Precise network controls retain hostname, path, port, time, and originating process. Confirmed C2 and download URLs can enter isolation and historical search. Legitimate exchange URLs in the decoy configuration and an entire multi-tenant platform stay outside default blocking. If an emergency platform-wide control is used, record business effect, owner, expiry, replacement detection, and narrowing condition.

Exposure assessment proceeds beside eradication. Files, screens, system survey, credentials, and child processes each receive a confirmed evidence stage. Configuration, controller, and logging gaps each identify the decision they affect. Rebuild can proceed immediately from demonstrated loss of control while notification scope continues to improve as evidence arrives.

7 Acceptance proves that roles, sessions, entrances, and effects stay absent

Closure consists of reproducible results. Every item contains a query or test, data source, scope, interval, result, evidence link, owner, and date. A green status is valid only when the underlying object can be opened and understood. Quiet alerts, a dead domain, or a software inventory showing a newer version cannot close the incident alone.

7.1 One reboot and a full former operating window are the minimum observation period

First verify that isolation blocks DNS, TLS, WebSocket, outbound RDP, and direct-IP alternatives. Then confirm that all three roles, MARKETMAKER, external DLLs, configuration, Run/Startup entries, hidden-window set, and known package objects are gone. After rebuild, cross one reboot or logon transition and observe at least one complete former operating window. Search outside 09:00–18:00 as well. Offline assets and retention cutoffs remain visible in the result.

Each entrance has a separate acceptance test. Read version and signer from every WinRAR and unrar.dll path and use a benign archive to verify that entries cannot escape the selected directory. Use a benign RDP file to test mail handling, provenance warning, destination policy, resource redirection, and egress. Test HTA application control and script-host telemetry. MSI, mailbox, compromised website, and domain-controller work each verify that malicious objects, account routes, persistence, and administrative trust are repaired.

Historical hunts begin before the earliest plausible access and cover all retained data. They search published hashes, GTIG rule clusters, configuration shapes, window names, role relationships, external modules, and behavioral correlation. Public rules are tested against lawfully retained positive material and benign websocket-sharp, WMI, installer, registry, and screen-sharing controls. Record rule-text hash, engine, scope, offsets, and retention. A rule that finds only an old digest remains indicator coverage.

An analyst who did not perform the original work should replay one task from the preserved mail, containers, configuration inputs, endpoint exports, memory record, network evidence, and provider material. They should reproduce role classification, delivery stage, service relationship, host effect, and exposure conclusion. Joins that depend on personal memory, an expired dashboard, or an inaccessible temporary file need new evidence or a lower confidence grade.

7.2 Unknowns retain an owner, consequence, and stopping condition

An undecryptable configuration may hide another service address. Missing memory may remove UUID, key, and local-message evidence. Short proxy retention may prevent accurate device and byte-direction mapping. Missing provider snapshots may erase the transient queue. Absent foreground-window context may leave screenshot content unresolved. Endpoint products without WM_COPYDATA visibility may limit direct IPC confirmation. Each unknown states the decision affected, alternative source, owner, deadline, and accepted consequence.

Long-term readiness is measured through relationship coverage: the share of endpoints that can assign a non-browser WebSocket to a process, the share that can connect same-session sys effects back to cor and net, retention for windows and memory, clock alignment across mail, endpoint, proxy, and identity data, provider-preservation latency, and central search coverage for external DLLs and configurations. Each benign exercise starts at delivery and walks through local handoff and egress, recording where a relationship key disappears.

After acceptance, the organization should be able to state a short conclusion: the entrance is repaired, administrative and identity trust is restored, roles and dependencies did not return, the exact session route is interrupted, historical search covers known retention, exposure is stated at the highest evidenced stage, and every remaining unknown is explicitly accepted or still being investigated. Those results allow a device and account to return to the trusted boundary.

8 Appendix: technical receipts that change identity, scope, or action

8.1 Samples and rules pin the role boundary

The actor-compiled websocket-sharp.dll, SHA-256 d1e54270433a94aa3d45d888e4c62299bee3480eb2cb4a5489c7dda69d476c3e, carries the timeline from a 2022 build artifact into multiple broker packages. It connects development material when package context excludes legitimate websocket-sharp software. The first public three-role archive in December 2023 establishes the division of labor. The 2024 MSI and 2025 MARKETMAKER package repeat those duties under new digests. The November external-module branch shows why role identity must include loaded modules and package relationships.

GTIG's G_Downloader_STOCKSTAY_MARKETMAKER_1 joins persistence, download, extraction, and proxy discovery in one method cluster. G_Controller_STOCKSTAY_STOCKMARKET_1 locates cor through protocol methods, timers, and SQLite strings. G_Tunneler_STOCKSTAY_STOCKBROKER_1 joins the WebSocket to the wmCopyData handoff. STOCKTRADER rules use command handlers and FNV1a patterns to locate sys. These rules provide static identity; endpoint telemetry determines execution and effect.

The public page contains one role conflict that must remain visible. Metadata for G_Backdoor_STOCKSTAY_STOCKTRADER_3 names SHA-256 82707cfdf24dcb762f4615f01e1ba4d3dfdec4abe9cd588558d2634d7e6a5eeb, while GTIG's February 2024 artifact table assigns the same digest to StockMarketView.exe, the orchestrator. Responders should let the handler cluster, local offsets, and independently acquired worker digest carry the role judgment. That digest should not be relabeled as STOCKTRADER until the source inconsistency is clarified.

The victim-facing Python controller digests are server.py at f04f43b6f7c2d86109c495179b497f7fb45fd95816623de1b77900f71b4f99ed, models.py at 7615140f78d9a0ce31cc9fe8c54c60028a7439cb32526fd97b10afef7145dd78, and wtools.py at b55f3b8a7334af049ba3f70a9ad3fe78574b1e180c68baf9a7110d104387a636. No currently accessible public commit, branch, or tree can be pinned. A recovered copy should be compared with all three digests before its own line numbers are cited. The current verifiable locations remain /ws, four Tornado handlers, and two SQLite tables.

8.2 Family history and attribution carry only scope decisions

The public timeline runs from the 2022 library build through a combined 2023 program and role split, 2024 environmental keying and MSI packaging, and 2025 RDP/HTA/RAR delivery, K1MORPHER, and external modules. It shows that the role relationship survives filenames and that older plaintext and newer obfuscated forms can coexist. The actor has published no semantic release train or complete manifest, so a local report should name the digest, role, dependencies, configuration, collection source, and time it actually examined.

GTIG attributes the observed STOCKSTAY ecosystem and related activity to Turla with high confidence. Its assessment of partial shared developers or teams with KAZUAR is moderate confidence, and its fallback or replacement-channel explanation is low confidence. Windows-1251, the public Squirrel3 algorithm, lure themes, and one multi-tenant domain each carry limited weight. Co-deployment, proprietary-tool context, implementation overlap, and incident sequence strengthen the combined case. CISA's government attribution of Snake to Center 16 of Russia's Federal Security Service supplies actor context and cannot replace STOCKSTAY sample and incident evidence.

The operational conclusion remains one sentence: delivery object, cor, sys, net, the /ws relay, and the original trust surface belong to one response task. Filenames, hashes, domains, rules, family history, and attribution serve that relationship. New material enters the main narrative only when it changes role membership, incident scope, response action, or acceptance result.