wool-basalt-clock.glitch[.]meDomain
Reported by 1 independent source · first reported by Google Threat Intelligence · last reported
Last reported 3 months ago
What the reports say
1 report, newest first · the exact sentence from each-
STOCKSTAY Another Day: The Latest Addition to Turla’s Intelligence Gathering Apparatus“The successfully decrypted configuration defined a STOCKSTAY WebSocket C2 URL of wss://wool-basalt-clock.glitch[.]me/ws.”
Indicators reported together
named in the same reports- shell[.]runin 1 report
- 4.4.3[.]12in 1 report
- container[.]targetin 1 report
- d1e54270433a94aa…dda69d476c3ein 1 report
- e6d8192960a89d54…b7c1f72341b6in 1 report
- 1fc23ec18a94a599…b5e7e81a6a24in 1 report
- 1a2ca8b8e0344fe3…df934ddc011fin 1 report
- 81aabf646619ea5f…b33613021bacin 1 report
- 9164054d0bf0b7c8…dd07b6bd67ecin 1 report
- 34fcbe7e90fc87a4…10d58911368bin 1 report
- 0a545dd1b703cddf…1eb837bda61bin 1 report
- 2623c6e3c1f5a7b5…0e7b096627f7in 1 report
- hxxps://circoloesteri.elezioni.idnet[.]it/admin-election/riepilogo.phpin 1 report
- circoloesteri.elezioni.idnet[.]itin 1 report
- hxxps://www.circoloesteri[.]it/in 1 report
- www.circoloesteri[.]itin 1 report
- b064a3efb04ed77e…e9b701ea2cffin 1 report
- 82707cfdf24dcb76…634d7e6a5eebin 1 report
- 249a4c7cacdd8e99…24dca6c51ecbin 1 report
Copy these 19 indicators · defanged
Also named with it: CVE-2025-8088
Thanks — we review every report.