To make matters simple for malware to access a website hosted in the Tor, free services like Tor2web enable anyone to connect to an onion site with any regular browser. Kaspersky also noted that a few banking malware families, such as 64-bit ZeuS Trojans, use Tor connections. There are also some ransomware variants like Onion that use Tor to hide their C&C servers. In 2013, Trend Micro blogged about the Mevede malware using Tor to hide their C&C servers. Tor uses a network comprised of thousands of volunteer-run servers known as Tor relays, which obfuscates the source and destination of a network connection. Anyone conducting monitoring or analysis will only see the traffic coming from the Tor exit node and will not be able to determine the original IP address of the request. Tor also has a browser-based on Firefox ESR that aims to make all users look the same, making it difficult for anyone to be fingerprinted based on their browser and device information.Īlthough Tor’s primary purpose is to protect its users’ privacy, it is increasingly used by threat actors to hide their malware’s network traffic.

Tor uses the Onion Routing Protocol to obfuscate the user’s identity from anyone seeking to monitor online activity.

How to use tor browser books