Sandworm Uses SSH-over-Tor Tunnel for Stealthy Long-Term Persistence

A significant evolution in Sandworm (APT-C-13) tradecraft, revealing the group’s use of SSH-over-Tor tunneling to achieve long-term, covert persistence inside targeted networks.

Sandworm, also known as FROZENBARENTS, is a state-sponsored threat group active since 2014. It has consistently targeted government bodies, energy firms, and research institutions, focusing on intelligence collection.

The attack begins with spear-phishing emails carrying ZIP archives that contain malicious Windows shortcut (LNK) files.

These files are disguised as legitimate documents, often mimicking PDFs to trick users into executing them.

The activity, identified by 360 Advanced Threat Research Institute, highlights a sophisticated blend of anonymity, encryption, and stealth designed to bypass traditional defenses.

Once opened, the LNK file triggers a multi-stage infection chain. It extracts hidden payloads from nested archives and executes a PowerShell-based control script.

This script deploys multiple components and establishes persistence using scheduled tasks disguised as legitimate applications like Opera GX and Dropbox.

At the same time, a decoy PDF is displayed to distract the victim, while the malware silently installs itself in the background.

SSH-over-Tor Tunnel

The most notable feature of this campaign is the creation of a dual-layer encrypted tunnel combining Tor and SSH.

• Tor is used to create a hidden service (.onion domain), exposing internal services such as SMB (port 445) and RDP (port 3389) to the attacker.
• SSH is deployed inside the Tor tunnel, providing a secure, authenticated backdoor using public key authentication.

This setup allows attackers to remotely access compromised systems without exposing open ports to the internet.

Upon execution, the script immediately performs strict sandbox and virtual machine detection logic, determining the host environment by verifying the number of `.lnk` files.

Because the SSH service listens only on localhost and communicates through Tor, it becomes extremely difficult for traditional security tools to detect.

For example, an attacker can connect via Tor to a hidden onion address, which internally routes traffic to the victim’s RDP service effectively bypassing firewall protections.

Sandworm integrates multiple evasion techniques to avoid detection:

• Obfs4 traffic obfuscation disguises Tor traffic as random TCP data, bypassing deep packet inspection (DPI).
• Scheduled tasks are hidden from standard system views and configured to run indefinitely.
• Malware components are disguised as legitimate software such as browsers and cloud tools.
• Anti-analysis checks terminate execution in sandbox or virtual environments.

Additionally, the malware deletes traces of its installation and ensures only a single instance runs using mutex controls.

Persistence and Control

The malware establishes persistence through scheduled tasks triggered at user logon. These tasks launch the Tor and SSH services automatically, ensuring continuous access even after system reboots.

Once the Tor hidden service is active, the malware sends victim identification data to a hardcoded onion-based command-and-control (C2) server. This enables attackers to maintain long-term monitoring and control.

Researchers attribute this campaign to Sandworm based on overlapping techniques, infrastructure design, and historical patterns.

The use of nested Tor and SSH tunnels mirrors earlier Sandworm operations but introduces improved modularity and stealth.

This development marks a shift from traditional backdoors to fully anonymized remote access frameworks. By embedding internal services into the dark web, attackers effectively bypass perimeter security models.

This campaign highlights the growing challenge of detecting encrypted and anonymized attack channels. Organizations should prioritize:

• Monitoring unusual scheduled task creation.
• Inspecting outbound Tor-like traffic patterns.
• Restricting unauthorized SSH services.
• Training users to पहचान phishing attachments.

The findings reinforce the need for layered defenses and proactive threat hunting, as advanced groups continue refining covert persistence techniques.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.