Pulse Detail — Threat Intelligence

PULSE NAME

Analysis of Attack Activities Using SSH+TOR Tunnels to Achieve Covert Persistence

WHITE APT-C-13, Sandworm, FROZENBARENTS Tr1sa111 2026-05-04 Modified: 2026-05-04

IOCs

LOW VOLUME

MITRE ATT&CK & Malware Families

ATT&CK TECHNIQUES

Indicators of Compromise (9)

All FileHash-MD5 FileHash-SHA1 FileHash-SHA256 domain

TYPE	INDICATOR	DESCRIPTION	CREATED
FileHash-MD5	2156c270ffe8e4b23b67efed191b9737	—	2026-05-04
FileHash-SHA1	975d8bdfec6b58ae9004d526fa9f852108026a9c	—	2026-05-04
FileHash-SHA256	0a78005858bef767b39cfbbeb543a80dfde46807ee75594de77d3ddfe119e8b5	—	2026-05-04
domain	2zrek3mkl72d5b6evpkx2rz2glzrltiorgblpfb2ttg6lacwlsdk4iqd.onion	—	2026-05-04
domain	3xl6xhboulyuez6fuydyhj7pdvkshzn4ogsmgwbb3ukrkvgi6bcwvfyd.onion	—	2026-05-04
domain	e3mnde5uyuxjoztup6t3m7nykbicexbzra76ucligwgsaez65w63y2ad.onion	—	2026-05-04
domain	imnlyhj4mtmtesqrvf7c4ma6dkxeyxw3ae53w6fuz42spndg7zpat6qd.onion	—	2026-05-04
domain	kvk46su7d2qi6g4n43syp4zbsf2rihnc6ztj77qtc2ojvewjqvqilnqd.onion	—	2026-05-04
domain	nytiplwknkinobjaeb5tajjiglip3vtaccju6ta7d47u5u64ktrwhrqd.onion	—	2026-05-04

References (1)