Turla (Secret Blizzard) APT: STOCKSTAY and Kazuar Backdoors Explained

Key Takeaways Turla, linked to Russia's FSB, has conducted cyber-espionage operations against governments and military organizations since 2004. The group routinely hijacks other threat actors' infrastructure to deploy its own tools and expand operational reach. STOCKSTAY and Kazuar backdoors form the core of Turla's custom malware toolset for long-term intelligence collection. Turla conceals command-and-control traffic by routing it through legitimate services like Cloudflare Workers and GitHub. The Picus Platform lets security teams simulate Turla attacks and validate defenses against its observed techniques. Turla (aka Secret Blizzard, Snake, and Uroburos) is a Russia-aligned advanced persistent threat (APT) group linked to the Federal Security Service (FSB), active since at least 2004. It is one of the longest-running cyber-espionage operations tracked publicly.