Loading threat actor…
Vortex Werewolf is a cyber-espionage threat cluster active since at least December 2025 that targets Russian government and defense organizations, with additional targeting reported in Belarus. The group’s objective is to establish persistent covert remote access on victim systems rather than conduct overtly destructive or financially motivated operations. The actor relies on phishing-driven intrusion chains. Lures commonly imitate legitimate file-sharing notifications and trusted services, including Telegram-themed messages. Victims are directed to a fraudulent download portal that captures phone numbers and login confirmation codes, enabling session hijacking, and are then redirected to legitimate cloud file-hosting services to retrieve a malicious archive. The delivered archive contains a weaponized Windows shortcut that launches PowerShell. Vortex Werewolf uses staged execution and defense-evasion measures, including sandbox checks, before installing Tor and OpenSSH to create anonymized command-and-control tunnels. The operators configure remote access and file-transfer channels over protocols including RDP, SMB, SFTP, and SSH, routing communications through Tor hidden services to conceal infrastructure and maintain covert access. Persistence is achieved through mechanisms designed to survive reboots, including scheduled tasks that automatically start the Tor client and SSH server. The activity has also been referred to as Operation SkyCloak. Reporting has noted behavioral similarities to Core Werewolf, while distinguishing Vortex Werewolf through its use of obfuscation and Tor-based communication bridging. Known aliases include vortex_werewolf.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
9 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
2 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named as an attribution-associated activity cluster in relation to the post-takedown QakBot ecosystem, but the content does not provide operational detail beyond that association.
Targets Russia and Belarus with the goal of establishing persistent remote access by deploying Tor and OpenSSH; campaign also referred to as Operation SkyCloak by Seqrite Labs.
Targets Russia and Belarus with the objective of establishing persistent remote access by deploying Tor and OpenSSH; campaign also referred to as Operation SkyCloak by Seqrite Labs.
Cyber-espionage activity cluster targeting Russian government and defense entities via phishing and social engineering to establish persistent covert remote access. Uses legitimate utilities (Tor, OpenSSH) and Windows scheduled tasks to maintain access and route C2/remote administration over Tor Hidden Services, enabling command execution and file transfer over RDP/SMB/SFTP/SSH.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.