Operation SkyCloak: Legitimate Tool Misuse from User-Writable Directories

Tim Peck@timpeck

•updated Oct 31, 2025•7•0•71

Detects the execution of legitimate tools (like sshd, tor, obfs4proxy) or their renamed counterparts from user-writable directories, specifically within AppData folders. This technique is associated with Operation SkyCloak to establish persistence and covert communication channels by masquerading as legitimate software.