Hackers Hide SSH–Tor Backdoor Inside Weaponized Military Documents

In October 2025 Cyble Research and Intelligence Labs (CRIL) uncovered a sophisticated malware campaign that distributes weaponised ZIP archives disguised as military documents, with Belarusian military personnel being the primary target. The attackers use OpenSSH for Windows alongside a customised Tor hidden service with obfs4 traffic obfuscation to provide anonymous remote access via SSH, RDP, SFTP and SMB.

The infection chain relies on nested ZIP archives, LNK file disguises and anti-sandbox checks, and powershell-based payloads that extract to the %appdata% directory before establishing two scheduled tasks for persistence. The operation’s Tor traffic is designed to resemble normal network activity, and an onion address is used to exfiltrate compromised-system data to the command-and-control infrastructure.

While researchers associate the activity with Sandworm, researchers caution that high-confidence attribution requires a targeting pattern, and Ukraine’s CERT-UA and SSSCIP have noted a surge in cyber incidents in 2025 involving AI-generated phishing and increasingly sophisticated malware. The campaign also builds on tactical patterns from the December 2024 Army+ operation, with obfs4, pre-generated RSA keys and multi-protocol access persisting on compromised hosts.