Vortex Werewolf
Vortex Werewolf is a cyber-espionage activity cluster targeting Russian government and defense organizations, with additional targeting reported in Belarus, active since at least December 2025. The cluster conducts phishing campaigns using lures that mimic legitimate file-sharing notifications (often themed as Telegram). Victims are directed to a fake Telegram download portal designed to capture phone numbers and login confirmation codes and hijack active sessions, then redirected to legitimate file-hosting services (e.g., Dropbox) to retrieve a malicious ZIP archive. The ZIP contains a weaponized Windows LNK that launches PowerShell, performs sandbox-evasion checks, and installs Tor and OpenSSH to establish persistent, covert remote access. The operators use Tor (including Tor Hidden Services) to anonymize command-and-control and route remote administration and file transfer over RDP, SMB, SFTP, and SSH, and they implement persistence via Windows scheduled tasks to auto-launch the Tor client and SSH server. The campaign was previously reported in November 2025 by Cyble and Seqrite Labs (as “Operation SkyCloak”), and BI.ZONE reported identifying the cluster in early 2026, noting behavioral similarities to Core Werewolf but with distinct obfuscation/bridging for C2 communications.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
9 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Targets Russia and Belarus with the goal of establishing persistent remote access by deploying Tor and OpenSSH; campaign also referred to as Operation SkyCloak by Seqrite Labs.
Targets Russia and Belarus with the objective of establishing persistent remote access by deploying Tor and OpenSSH; campaign also referred to as Operation SkyCloak by Seqrite Labs.
Cyber-espionage activity cluster targeting Russian government and defense entities via phishing and social engineering to establish persistent covert remote access. Uses legitimate utilities (Tor, OpenSSH) and Windows scheduled tasks to maintain access and route C2/remote administration over Tor Hidden Services, enabling command execution and file transfer over RDP/SMB/SFTP/SSH.
Intrusion activity targeting Russian government and defense organizations over a recent two-month period (details of tooling/TTPs not provided in the excerpt).
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.