Operation SkyCloak Deploys Tor-Enabled OpenSSH Backdoor Targeting Defense Sectors

Operation SkyCloak is a campaign that uses phishing to deliver a backdoor that combines OpenSSH with a Tor hidden service, designed to target defence sectors in Russia and Belarus. According to Cyble and Seqrite Labs, the attack chain begins with a ZIP file containing a hidden folder and a Windows LNK file, triggering a multi‑stage infection that includes a PowerShell stager for environment checks to evade sandboxes.

After these checks pass, a PDF decoy is shown and persistence is established via a scheduled task named "githubdesktopMaintenance" that launches logicpro/githubdesktop.exe—a renamed OpenSSH sshd.exe—enabling an SSH service and SFTP with pre‑deployed keys. The campaign also deploys a second scheduled task to run logicpro/pinterest.exe, a customised Tor binary used to create a hidden service that communicates with the attackers’ .onion address and forwards multiple Windows services through Tor.

It remains unclear who is behind it, but the activity is described as consistent with Eastern European‑linked espionage, with Cyble noting medium confidence of overlaps with a threat actor tracked by CERT‑UA as UAC‑0125.