New Sandworm Tradecraft Uses SSH-over-Tor Tunnel for Long

Cybersecuritynews •Tushar Subhra Dutta • April 28, 2026

A state- threat group, Sandworm (also tracked as APT-C-13 and FROZENBARENTS), has launched a targeted cyberattack campaign using a combined SSH and Tor tunneling technique to maintain long-term hidden access inside victim networks. This campaign marks a clear upgrade from the group’s earlier intrusion tactics, shifting from simple malware callbacks toward a fully anonymous, encrypted […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Sandworm Leverages SSH-over-Tor for Covert Network Access Sandworm (APT-C-13), a state-sponsored cyber threat group, has advanced its tactics by employing SSH-over-Tor tunneling to maintain long-term, covert access to targeted networks. This new technique represents a significant upgrade from previous methods, allowing for anonymous and encrypted communications. The group has historically targeted government entities, energy sectors, and research institutions since its inception in 2014. The attack typically initiates with spear-phishing campaigns to gain initial access. The full scope of the impact is still being assessed, but the shift in tactics indicates a more sophisticated approach to cyber espionage. Current reports suggest that this campaign is ongoing, with potential implications for national security and critical infrastructure. Specific tools and CVEs have not been disclosed in the articles, but the use of Tor suggests a focus on evasion and stealth. 2 sources 73

Extracted Entities

New Sandworm Tradecraft Uses SSH-over-Tor Tunnel for Long

The full story

Extracted Entities

APT Groups (3)

Attack Types (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)