Back Cybersecuritynews

Vortex Werewolf Attacking Organizations to Gain Tor-Enabled Remote Access Over the RDP, SMB, SFTP, and SSH Protocols

Cybersecuritynews •Tushar Subhra Dutta • February 9, 2026

A new cyber espionage cluster has recently emerged, focusing its aggressive targeting on Russian government and defense organizations. Active since at least December 2025, the group, designated as Vortex Werewolf, employs a combination of social engineering and legitimate software utilities to breach secure networks. Their primary objective appears to be establishing persistent, covert remote access […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Vortex Werewolf Cyber Espionage Targets Russian Organizations with Remote Access Tools The Vortex Werewolf cyber espionage group has been actively targeting Russian government and defense organizations since at least December 2025. This group utilizes social engineering and legitimate software utilities to establish covert remote access via Tor-enabled protocols such as RDP, SMB, SFTP, and SSH. 2 sources 33

Extracted Entities

Vortex Werewolf Attacking Organizations to Gain Tor-Enabled Remote Access Over the RDP, SMB, SFTP, and SSH Protocols

The full story

Extracted Entities

Industries (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (3)