[turla]

June 29, 2026

• Turla has added new malware, StockStay, to Russia's espionage campaigns against Ukraine, per Google threat researchers. (The Record) · Threat Activity

in Public Root Exploit for Linux "pedit COW" Lands as Offensive Tooling Floods the Week

June 28, 2026

• Turla is deploying a new backdoor, StockStay, against Ukrainian government and military organizations for espionage, per Google/Mandiant. SecurityWeek, Mandiant · Threat Activity

in A WHQL-Signed Kernel Backdoor Hides in a WFP Callout as a "Clean" GitHub Repo Pwns AI Coding Agents

June 27, 2026

• Turla has been attributed to a previously undocumented .NET backdoor, STOCKSTAY, deployed against Ukrainian government and military targets and entities tied to Italian foreign policy, per Google Threat Intelligence Group. The Hacker News · Threat Activity

in Amazon Q Coding Assistant Hijacked Through Malicious MCP Configs as Washington Starts Gating Frontier Models Customer-by-Customer