Google Details Turla's New STOCKSTAY Backdoor Used in Ukraine Espionage Attacks
Google links Turla to STOCKSTAY, a new .NET backdoor used in phishing attacks against Ukraine government and military targets.
More info