Sandworm Uses SSH-over-Tor Tunnel for Stealthy Long

Gbhackers •Mayura Kathir • April 28, 2026

A significant evolution in Sandworm (APT-C-13) tradecraft, revealing the group’s use of SSH-over-Tor tunneling to achieve long-term, covert persistence inside targeted networks. Sandworm, also known as FROZENBARENTS, is a state- threat group active since 2014. It has consistently targeted government bodies, energy firms, and research institutions, focusing on intelligence collection. The attack begins with spear-phishing […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Sandworm Leverages SSH-over-Tor for Covert Network Access Sandworm (APT-C-13), a state-sponsored cyber threat group, has advanced its tactics by employing SSH-over-Tor tunneling to maintain long-term, covert access to targeted networks. This new technique represents a significant upgrade from previous methods, allowing for anonymous and encrypted communications. The group has historically targeted government entities, energy sectors, and research institutions since its inception in 2014. The attack typically initiates with spear-phishing campaigns to gain initial access. The full scope of the impact is still being assessed, but the shift in tactics indicates a more sophisticated approach to cyber espionage. Current reports suggest that this campaign is ongoing, with potential implications for national security and critical infrastructure. Specific tools and CVEs have not been disclosed in the articles, but the use of Tor suggests a focus on evasion and stealth. 2 sources 73

Extracted Entities

Sandworm Uses SSH-over-Tor Tunnel for Stealthy Long

The full story

Extracted Entities

APT Groups (3)

Attack Types (1)

Industries (2)

MITRE ATT&CK (1)