Vortex Werewolf
Summary
Espionage cluster BI.ZONE has tracked since at least Dec 2024, attacking Russian government and defence organisations; earlier public reporting described similar attacks on Belarusian government and defence bodies. In Dec 2025–Jan 2026 it used phishing with LNK files that run a PowerShell script, then installed Tor and OpenSSH on victims and routed command-and-control through obfs4 bridges rather than public Tor entry nodes, with scheduled tasks for persistence — giving the operators SSH access over a hidden service. It shares a decoy with Core Werewolf; BI.ZONE judges the data insufficient to attribute both to one actor. No state attribution.
Attribution
No state attribution
Tracked by researchers; no state or organisation has been publicly attributed.
- BI.ZONE (Research, 2026-02-06)
Tracks attacks on Russian government and defence organisations
Campaigns 1
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| LNK → PowerShell → Tor/OpenSSH over obfs4 — Russian government and defence | 2025-12 – 2026-01 | Russia | Government, Defense | BI.ZONE (2026-02-06) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 6
| Initial Access1 | T1566Phishing |
|---|---|
| Execution3 | T1204.002Malicious FileT1059.001PowerShellT1053.005Scheduled Task |
| Lateral Movement1 | T1021.004SSH |
| Command and Control1 | T1090.003Multi-hop Proxy |
Malware and tools 1
| Name | Description | Platform |
|---|---|---|
| Tor + OpenSSH + obfs4proxy (abused) | Legitimate tools installed for hidden SSH access | Windows |
Infrastructure patterns
- C2 over Tor hidden services, routed through obfs4 bridges rather than public entry nodes (BI.ZONE, 2026)
- Tor-enabled RDP, SMB, SFTP and SSH access on victims via installed Tor and OpenSSH (BI.ZONE, 2026)
- Telegram phishing domains, each with its own GitHub Pages repo serving static assets (BI.ZONE, 2026)