Tor

Operating systems

linux, windows, macos

Related IoCs

78 (14 malicious)

Last IoC activity

2026-09-01 23:58:01

Profile updated

2026-07-07 15:32:51

Context

Tor is a software suite and network that provides increased anonymity on the Internet. It creates a multi-hop proxy network and utilizes multilayer encryption to protect both the message and routing information. Tor utilizes "Onion Routing," in which messages are encrypted with multiple layers of encryption; at each step in the proxy network, the topmost layer is decrypted and the contents forwarded on to the next node until it reaches its destination.

Recent IoC activity

14 malicious indicators in Maltiverse are attributed to Tor (S0183). The 14 most recently updated:

Detection coverage

• 3 Sigma rules

Malware & tools used

• Asymmetric Cryptography (attack-pattern)
• Multi-hop Proxy (attack-pattern)

Used by threat actors

• FLORAHOX Activity (campaign)
• Operation Wocao (campaign)
• CostaRicto (campaign)
• 2025 Poland Wiper Attacks (campaign)
• Salesforce Data Exfiltration (campaign)
• Water Galura (threat-actor)
• Scattered Spider (threat-actor)
• INC Ransom (threat-actor)
• APT28 (threat-actor)
• APT29 (threat-actor)
• Leviathan (threat-actor)
• ShinyHunters (threat-actor)

Reports & references

• dtic.mil — A465464 (report)
• MITRE ATT&CK — S0183 (report)

External references

• mitre-attack — S0183
• Tor
• Dingledine Tor The Second-Generation Onion Router
• misp-galaxy
• misp-galaxy