Operation SkyCloak Targets Russian/Belarusian Military With LNK Exploit and OpenSSH Over Tor Backdoor

According to SEQRITE, the stealthy campaign dubbed “Operation SkyCloak” targets military personnel in Russia and Belarus, including the 83rd Separate Guards Airborne Assault Brigade in Ussuriysk and the 5th Separate Spetsnaz Brigade in Maryina Horka. It uses weaponised Windows LNK shortcut files disguised as military documents to trigger a PowerShell-based intrusion chain, with phishing archives uploaded from Belarus dated between October 15 and October 21, 2025.

The infection chain exposes local services via Tor using obfs4 bridges, enabling anonymous communication through an onion address and establishing a hidden Tor-based communication channel. SEQRITE notes that the attackers deploy legitimate OpenSSH binaries within a user’s profile directories, renamed to host SSH, SFTP, RDP and SMB services over Tor, and configure a non-standard port (20321) with public-key-only authentication.

The campaign employs mutexes, Windows Scheduled Tasks and a dynamically built onion address to maintain persistence and stealthy beacons, with several hidden services exposed on ports such as 20322 (SSH) and 11435 (SMB). Attribution remains uncertain, but SkyCloak shares similarities with Eastern European-linked espionage activity directed at defense and government sectors.