“Researchers have found a new theory to explain the sudden spike in computers using the Tor anonymity network: a massive botnet that was recently updated to use Tor to communicate with its mothership. Making a C&C server a Tor hidden service makes sense from an attacker’s perspective. Tor makes it much harder for white hats and law enforcement officers to identify the malware operators and to shut down the server. Instead of connecting to a registered IP address, an infected machine connects to a pseudo address such as vtipk3.onion that is hard—if not impossible—to trace. Researchers have been predicting that botnets would adopt Tor protocols since at least 2010.”
