Sandworm Uses SSH-over-Tor Tunnel for Stealthy Long-Term Persistence

This report describes a Sandworm (APT-C-13) campaign delivering malicious LNK files via spear-phishing ZIP attachments that execute PowerShell-based multi-stage payloads. The malware establishes persistence with scheduled tasks (masquerading as legitimate apps), deploys Tor hidden services and an SSH backdoor tunneled through Tor (SSH-over-Tor) to expose internal SMB/RDP services to operators, and uses obfs4, sandbox/VM checks, mutex controls and other evasion techniques; recommendations include monitoring scheduled-task creation, outbound Tor-like traffic, and restricting unauthorized SSH services.