In view of the extensive resources used and the effort involved, they are by no means amateurs. The broader focus of KAX17 suggests, according to Nusenu, that the “tenacious” group is trying to gather information about Tor members and record their routes within the network. Among other things, this enables them to change the user’s data traffic. This is unusual as most relevant attackers tend to focus on operating from point of origin. The devices are mainly configured as entry and center points, but there are also a small number of exit nodes. KAX17 does not only rely on cheap hosters, but also on the Microsoft cloud. The mysterious servers are usually located in data centers that are spread all over the world.

At any given point in time, the attacker had hundreds of nodes in operation. KAX17 is constantly adding new servers in large numbers to the network without contact information. He has now traced the phenomenon back to 2017. Read Also Cyber agency lags behind its own standards - too few employees Hundreds of knots at any given timeĪccording to one, Nusenu got from him this week published article identified a pattern on some of these Tor relays without email addresses.

Mit tor relays