Their role is to encrypt and anonymize user traffic as it enters and leaves the Tor network, creating a giant mesh of proxy servers that bounce connections between each other and provide the much-needed privacy that Tor users come for. Some of these servers work as entry points (guards), others as middle relays, and others as exit points from the Tor network. Tracked as KAX17, the threat actor ran at its peak more than 900 malicious servers part of the Tor network, which typically tends to hover around a daily total of up to 9,000-10,000. Since at least 2017, a mysterious threat actor has run thousands of malicious servers in entry, middle, and exit positions of the Tor network in what a security researcher has described as an attempt to deanonymize Tor users. The Tor Project has removed hundreds of KAX17 servers in October and November 2021.Evidence suggests the attacker, tracked as KAX17, is sophisticated and well-resourced.Researchers claims the attacker may be trying to deanonymize and identify Tor users.Security researcher claims to have identified threat actor running thousands of malicious servers.
A mysterious threat actor is running hundreds of malicious Tor relays
0 kommentar(er)
