Attack Activity Analysis Using SSH+TOR Tunnels for Covert Persistence

APT-C-13 (Sandworm), also known as FROZENBARENTS, is a state-sponsored advanced persistent threat group conducting global cyber espionage targeting government agencies, diplomatic departments, energy enterprises, and research organizations. Recently detected samples reveal the group's use of nested SSH and TOR tunnel architecture to establish covert communication channels. The attack begins with spear-phishing emails delivering malicious LNK files disguised as PDF documents. Upon execution, the payload deploys TOR hidden services mapping internal ports (SMB/445, RDP/3389) to onion domains, while SSH services with public key authentication provide encrypted remote access. The malware employs obfs4 protocol to obfuscate TOR traffic, evading deep packet inspection. Persistence is achieved through scheduled tasks masquerading as legitimate applications like Opera GX and Dropbox, establishing an anonymous shadow management infrastructure for sustained intelligence collection.

• Analysis of Attack Activities Using SSH+TOR Tunnels to Achieve Covert PersistenceCampaign2026-04-29
• Konni Hackers Target Ukraine With Malicious LNK Files and VelvetCake PowerShell MalwareMalware2026-09-24
• Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMsMalware2026-10-07
• China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoorMalware2026-09-30
• TASK#STOMP PowerShell Backdoor Steals Business Documents and Maintains Persistent Remote AccessMalware2026-09-24