Deep Persistence: How Sandworm Weaponizes Tor for Long-Term Stealth
Sandworm Uses SSH-over-Tor Tunnels for Stealthy Long-Term Persistence Sandworm – the Russian state-sponsored actor linked to GRU Unit 74455 – leveraged SSH-over-Tor tunneling to establish covert, resilient, long-term access inside compromised environments…
- APT
- Persistence
Bottom line. Treat this as a high-priority, state-sponsored intrusion. Hunt for Tor client processes and SSH sessions routed through local proxies, audit persistence mechanisms, and pivot to host and identity telemetry – because Tor hides the operator’s origin, network attribution alone will not save you.
Background
Sandworm operators established encrypted SSH tunnels routed through Tor anonymity services to conceal attacker infrastructure, reduce attribution visibility, and maintain resilient long-term access within compromised systems. The technique significantly complicates network attribution, traffic analysis, and traditional perimeter-based detection.
The use of SSH-over-Tor infrastructure reflects a mature operational-security posture commonly associated with advanced state-sponsored intrusion groups. It supports covert command-and-control, stealth persistence, and resilient attacker access even inside heavily monitored networks.
What we observed
The observed tradecraft centres on encrypted, anonymized remote access:
- Encrypted SSH tunneling: interactive operator sessions are carried inside SSH and routed over Tor circuits to hide their true origin.
- Hidden relay infrastructure: Tor client software is deployed on compromised systems or intermediary relay hosts to build the covert channel.
- Credential and access persistence: unauthorized keys and stealthy remote administration maintain access across reboots and defender activity.
- Detection resistance: combining SSH encryption with Tor anonymization sharply reduces forensic visibility and perimeter detection efficacy.
SSH-over-Tor persistence
Encryption hides the content; Tor hides the origin – together they erase most network attribution.
Attribution
Sandworm is a Russian state-sponsored threat actor linked to GRU Unit 74455, with a documented history of destructive and espionage operations. The SSH-over-Tor tradecraft is consistent with the group’s mature operational security; defenders should confirm specific campaign scope against their own telemetry.
Confidence: 85%.
Routing SSH through Tor doesn’t just encrypt the session – it erases the origin, turning attribution into guesswork.
Tactics, techniques & procedures (MITRE ATT&CK)
Techniques below are drawn directly from the analysed samples/reporting – no technique is asserted without evidence:
| Tactic | Technique | ID | Evidence |
|---|---|---|---|
| Command and Control | Proxy: Multi-hop Proxy | T1090.003 | Uses Tor multi-hop circuits to anonymize operator traffic and conceal infrastructure. |
| Command and Control | Protocol Tunneling | T1572 | Tunnels interactive SSH sessions through the Tor channel. |
| Lateral Movement | Remote Services: SSH | T1021.004 | Uses SSH for covert remote administration of compromised hosts. |
Detection
Copy-ready hunting query:
# Hunt for Tor processes and Tor-tunneled SSH (Linux)
ss -tnp | grep -E ':9050|:9150'
ps -eo pid,comm,args | grep -Ei '(^|/)tor( |$)|obfs4|meek'
# Unexpected SSH keys, ProxyCommand configs and cron/systemd persistence
find /root /home -name authorized_keys -newermt "2026-01-01" -ls
grep -RIn 'ProxyCommand' /root/.ssh /home/*/.ssh 2>/dev/null
ls -l /etc/cron.* /etc/systemd/system/*.service 2>/dev/nullRecommendations
- Hunt for Tor client binaries/processes and SSH sessions routed through local SOCKS proxies (ports 9050/9150); block or deny egress to Tor where operationally feasible.
- Audit for unauthorized authorized_keys entries, SSH ProxyCommand configurations, and new cron/systemd persistence, then rotate credentials and keys on affected hosts.
- Because Tor conceals C2 origin, prioritise host-based and identity telemetry over network attribution, and correlate anomalous privileged and SSH activity.
- Given Sandworm’s destructive history, preserve forensic evidence and hunt for follow-on staging before remediating, and rebuild systems where integrity cannot be assured.
