Pulse Detail — Threat Intelligence

● 0 online

ANALYZING THREAT INTELLIGENCE

PULSE NAME

Analysis of Attack Activities Using SSH+TOR Tunnels to Achieve Covert Persistence

WHITE APT-C-13, Sandworm, FROZENBARENTS Tr1sa111 2026-05-04 Modified: 2026-05-04

9

IOCs

LOW VOLUME

↓ CSV ↓ JSON

sandworm obfs4 apt-c-13 spearphishing ssh tunneling persistence mechanism tor network scheduled tasks

MITRE ATT&CK & Malware Families

ATT&CK TECHNIQUES

T1053.005 T1036.005 T1204.002 T1497.001 T1021.004 T1566.001 T1140 T1021.002 T1036.004 T1041 T1059.001 T1547.001 T1090.003 T1027 T1573.002 T1070.004 T1071.001 T1021.001 T1564.001 T1090.001

Indicators of Compromise (1 / 9 total)

All FileHash-MD5 FileHash-SHA1 FileHash-SHA256 domain

TYPE	INDICATOR	DESCRIPTION	CREATED
FileHash-MD5	2156c270ffe8e4b23b67efed191b9737	—	2026-05-04

References (1)

↗ https://www.360.cn/n/13005.html