value:  Keydnap uses a copy of tor2web proxy for HTTPS communications. ;; MacSpy uses Tor for command and control. ;; Operation Wocao has executed commands through the installed web shell via Tor exit nodes. ;; StrongPity can use multiple layers of proxy servers to hide terminal nodes in its infrastructure. ;; Traffic traversing the Tor network will be forwarded to multiple nodes before exiting the Tor network and continuing on to its intended destination. ;; Ursnif has used Tor for C2. ;; WannaCry uses Tor for command and control traffic.
name: Proxy: Multi