Weaponized Military Documents Deliver Advanced SSH-Tor Backdoor

CRIL identified an October 2025 espionage campaign distributing a weaponized ZIP disguised as a Belarusian military PDF that uses an LNK-triggered PowerShell chain, anti-sandbox checks, and scheduled tasks to deploy OpenSSH for Windows and a customized Tor hidden service with obfs4 bridging; the infrastructure exposes SSH, RDP, SFTP and SMB over .onion addresses using pre-generated RSA keys, enabling anonymous remote access. The report includes technical analysis, MITRE TTP mapping, indicators (file hashes and an .onion), mitigation recommendations, and assesses moderate confidence in similarities to Sandworm (APT44) while noting no secondary payloads were observed.