Vortex Werewolf Targets Organizations With Tor-Enabled RDP, SMB, SFTP, and SSH Backdoors

Vortex Werewolf (SkyCloak) is an APT campaign targeting Russian government and defense organizations that uses Telegram-themed phishing to steal session credentials and deliver LNK/PowerShell droppers; the payload installs a Tor-hidden OpenSSH backdoor, obfs4 proxy, and scheduled tasks to maintain covert, persistent remote access. The report provides a technical deep dive into the infection chain, infrastructure (GitHub Pages, Cloudflare), TTPs, and seven file-hash indicators of compromise.