INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

FBI and SSU Uncover Russian Cyber Espionage Operation Against Officials

| 2026-06-25 14:00 CRITICAL HIGH STATE-SPONSORED & ESPIONAGE
JSON
Executive Summary
AI-generated
A sustained Russian intelligence campaign targeting the messaging accounts of government officials, military personnel, politicians, and activists across Ukraine, Europe, and the United States has been uncovered by the Security Service of Ukraine (SSU) in collaboration with the FBI. The operation began years ago, with hackers systematically hacking Messenger accounts using low-tech methods such as sending SMS messages impersonating platform support bots to trick targets into handing over account credentials or personal data. This attack method is designed to be socially engineered and tends to arrive during morning hours when targets are less guarded. The scope of the campaign is broader than initially thought, with ordinary citizens also being targeted using this tactic.
Technical Mitigations AI-generated
• User Training (ATT&CK mitigation for Impersonation): Train users to be aware of impersonation tricks and how to counter them, for example confirming incoming requests through an independent platform like a phone call or in- • Threat Intelligence Program (ATT&CK mitigation for Impersonation): Threat intelligence helps defenders and users be aware of and defend against common lures and active campaigns that have been used for impersonation. • Network Intrusion Prevention (ATT&CK mitigation for Phishing): Network intrusion prevention systems and systems designed to scan and remove malicious email attachments or links can be used to block activity. • Restrict Web-Based Content (ATT&CK mitigation for Phishing): Determine if certain websites or attachment types (ex: .scr, .exe, .pif, .cpl, etc.) that can be used for phishing are necessary for business operations and consider bloc • Audit (ATT&CK mitigation for Social Engineering): Enables correlation of email/identity/SaaS/endpoint activity that appears legitimate.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Star BlizzardStar BlizzardTurlaTurla
Target & Sectors
EUROPE EUROPE NORTH_AMERICA NORTH_AMERICA educationeducation governmentgovernment defensedefense
Incident Timeline
‎December 2022
Threat actors associated with Turla's intelligence gathering apparatus, codenamed STOCKSTAY, began developing the malicious software in December 2022.
organisation GTI Collection
To assist the wider community in hunting and identifying activity outlined in this blog post, we have included indicators of compromise (IOCs) within each observed operation section, and in a GTI Collection for registered users.
‎late 2023
Threat actors, identified as Turla, added a new component to their STOCKSTAY intelligence gathering apparatus in late 2023.
‎April 2024
Threat actors using KAZUAR's multi-class obfuscation techniques, as observed in suspected test builds of STOCKSTAY hosted on a compromised Cypriot website in April 2024, have been mimicking this approach within the STOCKSTAY ecosystem.
target_region Cyprus
The actor’s use of K1MORPHER within STOCKSTAY appears to be trending toward mimicking KAZUAR’s multi-class obfuscation techniques, where obfuscation is handled by multiple distinct classes, as observed in suspected test builds of STOCKSTAY hosted on a compromised Cypriot website in April 2024.
organisation KERNEL
Within the KAZUAR ecosystem, these components are referred to as “BRIDGE”, “KERNEL”, and “WORKER”, respectively.
organisation DIAMONDBACK
DIAMONDBACK, a dropper often deployed prior to KAZUAR in the execution chain, has made use of a hash of the target’s hostname in decrypting its payload, to prevent divulgence of its intentions outside of the target environment.
organisation WordPress
Both ecosystems rely heavily on .NET development, and have been observed using compromised WordPress sites during various stages of their operations.
‎at least 2024
Threat actors, identified as Turla, have been observed deploying the KAZUAR implant using a multi-component architecture since at least 2024.
organisation Implant Architecture   Since
Implant Architecture   Since at least 2024, KAZUAR has been observed being deployed using a multi-component architecture, whereby C2 communication, task orchestration, and task execution are managed by separate components.
‎April 2025
Threat actors using the Turla intelligence gathering apparatus updated STOCKSTAY with a new string obfuscation mechanism based on "Squirrel3" in April 2025.
‎June 2025
Threat actors used XOR operations to obfuscate their KAZUAR code, a departure from the malware's historical use of junk code and string substitution tables.
organisation XOR
KAZUAR has historically used its own simple but effective code and string obfuscation techniques to evade detection, such as: the insertion of junk code; replacing static constant values with the results of XOR operations; and large quantities of unique character substitution tables.
‎early 2025
Threat actors used a phishing email claiming to be from a defense-related training academy as part of an operation in early 2025.
tactic Phishing
In one operation in early 2025, GTIG identified a phishing email, claiming to be sent by a defense-related training academy, containing a malicious RDP file attachment.
‎mid-2025
Threat actors used malicious RDP files to target victims on a compromised diplomatic-themed education platform in mid-2025.
‎2026/06/25
Russian hackers used a variety of tools and methods, including STOCKSTAY, to target government officials, military personnel, politicians, activists from Ukraine, Europe, and the USA.
organisation RDP
…an affinity for integrating academia and diplomacy into their infrastructure and lure/decoy content, including: compromising an email account belonging to a Ukrainian university to disseminate phishing emails; using the names of an academic institution within the file name of a malicious RDP file; compromising a diplomatic education platform for phishing and distribution of mal…
organisation KAZUAR
This was seen within Ukrainian networks where STOCKSTAY was deployed toward the end of an operation which had previously relied heavily on the group’s other tools, such as KAZUAR.
organisation VirusTotal
Early development samples of STOCKSTAY were identified in various European nations, including Italy, the Netherlands, Poland, and Germany; however, we have been largely unable to confirm the intended victims for the majority of these early infections, nor whether these samples were identified as a result of the threat actor testing their capabilities against publicly available virus scanning ser…
organisation The Latest Addition
STOCKSTAY Another Day: The Latest Addition to Turla’s Intelligence Gathering Apparatus.
threat_actor Turla
STOCKSTAY Another Day: The Latest Addition to Turla’s Intelligence Gathering Apparatus.
organisation Suspected European Targeting
Suspected European Targeting A smaller number of STOCKSTAY operations observed by GTIG appear to have been targeted at European entities.
organisation STOCKSTAY.MARKETMAKER
A short time following the victim’s connection to the actor’s infrastructure, the actor deployed STOCKSTAY.MARKETMAKER, a .NET downloader designed to retrieve and install the full STOCKSTAY suite on the victim’s device.
threat_actor Star Blizzard
The SBU didn’t attribute the campaign to a specific group by name, but prior reporting from Google, the FBI, and CISA ties similar activity to clusters tracked as UNC5792 and UNC4221 , both linked to FSB operations, as well as Star Blizzard .
Intelligence Sources
Security Affairs 2026-06-29
Mandiant 2026-06-25