Turla STOCKSTAY WebSocket C2 to wool-basalt-clock.glitch.me

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects HTTP traffic patterns associated with the Turla STOCKSTAY malware establishing a WebSocket connection to the known C2 domain 'wool-basalt-clock.glitch.me'. The rule monitors for a GET request containing specific HTTP headers (Upgrade: websocket) required for protocol switching to WebSocket, which is a common technique for establishing persistent C2 channels.