Operation SkyCloak: Tor Campaign targets Military of Russia & Belarus

MITRE Techniques

• [T1583 ] Acquire Infrastructure – The campaign configures Tor bridges, obfs4 proxies and an onion service to host command-and-control: ‘HiddenServiceDir “socketExecutingLoggingIncrementalCompiler/”‘ and Bridge entries for obfs4 endpoints.
• [T1566.001 ] Phishing: Spearphishing Attachment – Initial delivery via spearphishing ZIPs with decoy nomination/training documents and LNK shortcuts (‘The first lure is a nomination letter … The second decoy letter …’).
• [T1204.002 ] User Execution: Malicious File – Victims are lured to open decoy documents and execute shortcut-triggered payloads (‘Shortcut files … trigger PowerShell commands which act as the initial dropper stage’).
• [T1059.001 ] Command and Scripting Interpreter: PowerShell – PowerShell scripts perform extraction, anti-analysis checks, task registration, and beaconing via Tor (‘The command extracts the first archive … triggers PowerShell’, ‘The script starts by checking the Windows ‘Recent’ folder’).
• [T1106 ] Native API – Legitimate OpenSSH/OpenSSL binaries are used and launched with configuration arguments, leveraging native Windows services/APIs for SSH/SFTP functionality (‘legitimate “OpenSSH for Windows” binaries … PDB paths’).
• [T1053.005 ] Scheduled Task – Persistence via Windows scheduled task XML files that run daily and on demand (‘XML files are Windows scheduled task definitions that runs daily … These tasks are hidden and configured to run even when the computer is idle’).
• [T1547 ] Boot or Logon Autostart Execution – Attack sets tasks with logon triggers and hidden configuration to persist across logons (‘has a logon trigger for the user specified’).
• [T1027 ] Obfuscated Files or Information – Strings are concatenated and XMLs/text files are used to hide configuration and create onion addresses, adding obfuscation to operations (‘Multiple strings are concatenated to form the full onion address’).
• [T1036 ] Masquerading – Renaming legitimate binaries (ssh, sftp, tor, obfs4proxy) to benign names like githubdesktop.exe, googlemaps.exe, pinterest.exe to evade detection (‘githubdesktop.exe … pinterest.exe … confluence.exe renamed obfs4proxy’).
• [T1497 ] Virtualization/Sandbox Evasion – PowerShell checks Recent folder and process count to detect sandboxed environments and avoid execution (‘The script starts by checking the Windows ‘Recent’ folder and if it has more than ten shortcut files … Another check is done to see if the process count is greater than 50’).
• [T1083 ] File and Directory Discovery – Stager inspects folders (Recent, various AppData directories) and reads/writes hostname file written by Tor (‘The script starts by checking the Windows ‘Recent’ folder’ and ‘it waits until the hostname file exists’).
• [T1046 ] Network Service Discovery – Configuration exposes local services (SSH, SMB, RDP) via Tor hidden service ports to enable remote access (‘HiddenServicePort … 127.0.0.1:445 … 127.0.0.1:3389’).
• [T1033 ] System Owner/User Discovery – The beacon format includes username and onion address to identify infected host (‘creates an identification beacon in a specific format ‘::3-yeeifyem’’).
• [T1021 ] Remote Services – Deployment of OpenSSH and exposing ports over Tor enables remote services for lateral movement and administration (‘deploys a self-contained OpenSSH server inside a user’s profile directory using Tor’).
• [T1119 ] Automated Collection – The deployed SSH/SFTP services and configured subsystems can support automated data collection and transfer over the Tor channel (use of SFTP subsystem and authorized keys files in configuration).
• [T1071 ] Application Layer Protocol – Use of HTTP-like application-layer communication via curl over Tor SOCKS for beaconing and C2 (‘uses curl via local Tor SOCKS listener on port 9050’).
• [T1090 ] Proxy – Use of Tor and obfs4 bridges acts as a proxying technique to hide C2 communications (‘creates an onion service and exposes SSH, SMB, RDP and other ports over Tor’ and ClientTransportPlugin obfs4 entries).
• [T1571 ] Non-Standard Port – SSH listens on non-standard port 20321 internally and hidden-service ports map to non-standard ports for exposed services (‘Port 20321 … HiddenServicePort 20322 127.0.0.1:20321’).
• [T1041 ] Exfiltration Over C2 Channel – The Tor-hidden service with SSH/SFTP and automated beaconing implies use of C2 channels for potential exfiltration (‘creates an identification beacon … uses curl via local Tor SOCKS listener’ and SFTP subsystem present).