Sandworm APT Attacks Belarus Military With LNK Exploit and OpenSSH Over Tor obfs4 Backdoor

According to CRIL, researchers identified a sophisticated malware campaign that uses weaponised ZIP archives disguised as military training documents to infiltrate Belarusian Special Operations Command personnel involved in UAV and drone operations.

The October 2025 report details an infection chain beginning with a ZIP file titled “ТЛГ на убытие на переподготовку.pdf” that masquerades as a PDF while actually delivering a malicious LNK shortcut, with obfuscated PowerShell used to extract additional payloads and configuration files.

The campaign deploys two main components: a Microsoft-signed OpenSSH for Windows binary (githubdesktop.exe) listening on port 20321 with RSA key-based authentication, and a Tor-backed backdoor via a customized Tor executable (pinterest.exe) that creates a hidden service and exposes multiple ports for SSH, SMB, RDP and other backdoors, using obfs4 pluggable transport to disguise traffic.

The operators register each host with a unique .onion URL and transmit data including the victim’s username, the hidden service address, and a campaign identifier, then gain remote access through SSH, RDP, SMB or SFTP. Cyble notes strong overlaps between this October 2025 sample and the December 2024 Army+ campaign attributed to Sandworm (APT44/UAC-0125), suggesting this operation is part of ongoing espionage targeting Eastern European defence sectors.

The report also highlights that the campaign shows improvements in anonymity and persistence, while the overall activity is framed as reconnaissance or pre-exploitation in nature.