Tor hidden services – a safe haven for cybercriminals

Over the last few months I have been closely monitoring so-called Darknet resources, mostly the Tor network. And one thing that is immediately obvious is that the cybercriminal element is growing. Although, the Tor infrastructure and cybercriminal resources are not on the same scale as the conventional Internet, we managed to find approximately 900 hidden services online at the current time. There are also approximately 5,500 nodes in total and 1,000 exit nodes, but the possibility of creating an anonymous and abuse-free underground forum, market or malware C&C server is attracting more and more criminals to the Tor network.

Malware

Cybercriminals have started actively using Tor to host malicious infrastructure.  We found Zeus with Tor capabilities, then we detected ChewBacca and finally we analyzed the first Tor Trojan for Android. A quick look at Tor network resources reveals lots of resources dedicated to malware – C&C servers, admin panels, etc.

Hosting C&C servers in Tor makes them harder to identify, blacklist or eliminate.

 
Cythosia botnet webpanel

Read more: Tor hidden services – a safe haven for cybercriminals