With all these recent publications about NSA spying activities, with the new Russian legislation banning several websites, and the general distrust that prevails for major internet sites like Google, Facebook, etc., it should come as no surprise that people are starting to look for ways to protect their privacy.
So, the increase in the number of people using the Tor, which offers anonymous, encrypted traffic on the internet, was expected.
A few days ago, we published the finding that the number of people using the Tor network had doubled. So far so good. But a spike of two million users, from 500,000, in just a few days seems a little suspicious.
Not only suspicious but actually, it's a clear sign that someone is up to something that's probably not good. Someone noticed it and decided to check it out further. The investigation showed that all new connections through Tor are being used by a Russian botnet.
The botnet has been known for some time, but it seems to have started using Tor for its communications with the command and control center. This makes the location of the central malicious servers invulnerable, as they are difficult if not impossible to find.
Analysis of the malware using the network has not revealed much, meaning it is still unclear what its processes are. Typically, botnets are used to offer “fake clicks”, steal information from bank accounts, distribute ransomware and more.
https://metrics.torproject.org/network.html
