Russia-linked APT Turla has been using the StockStay backdoor against government and military organizations in Ukraine.