- Security researcher claims to have identified threat actor running thousands of malicious servers.
- Researchers claims the attacker may be trying to deanonymize and identify Tor users.
- Evidence suggests the attacker, tracked as KAX17, is sophisticated and well-resourced.
- The Tor Project has removed hundreds of KAX17 servers in October and November 2021.
Since at least 2017, a mysterious threat actor has run thousands of malicious servers in entry, middle, and exit positions of the Tor network in what a security researcher has described as an attempt to deanonymize Tor users.