> ## Content Index
> Fetch the complete content index at: https://werd.io/llms.txt
> Use this file to discover other available public pages before exploring further.

# A mysterious threat actor is running hundreds of malicious Tor relays
- URL: https://werd.io/a-mysterious-threat-actor-is-running-hundreds-of-malicious-tor/
- Published: 2021-12-07T17:38:50.000Z
- Updated: 2021-12-07T17:38:50.000Z
- Author: Ben Werdmuller
- Tags: #Import 2025-06-13 09:24

"Since at least 2017, a mysterious threat actor has run thousands of malicious servers in entry, middle, and exit positions of the Tor network in what a security researcher has described as an attempt to deanonymize Tor users. \[...\] at one point, there was a 16% chance that a Tor user would connect to the Tor network through one of KAX17’s servers, a 35% chance they would pass through one of its middle relays, and up to 5% chance to exit through one."

\[[Link](https://therecord.media/a-mysterious-threat-actor-is-running-hundreds-of-malicious-tor-relays/)\]