Sandworm, a state-sponsored threat group also known as FROZENBARENTS, has adopted a new technique involving SSH-over-Tor tunneling to maintain long-term, covert access to targeted networks.