Turla STOCKSTAY WebSocket C2 to driverx86-adobe.onrender.com

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects HTTP traffic attempting to upgrade a connection to a WebSocket protocol directed towards the known Turla-associated command-and-control infrastructure 'driverx86-adobe.onrender.com'. This pattern is characteristic of the STOCKBROKER component within the STOCKSTAY malware framework, observed in recent phishing campaigns.