KAX17

Executive Summary

KAX17 is a long-term threat actor active since 2017, exploiting Tor network infrastructure to monitor user traffic and map network routes. Despite repeated takedown efforts, the group maintains hundreds of Tor nodes, suggesting persistence and resilience. Their activities pose risks to Tor users' anonymity and privacy.

Goals & Targeting

KAX17's primary objective appears to be surveillance and mapping of Tor users' activities, likely to compromise anonymity or gather intelligence on individuals using the network for sensitive communications. By targeting Tor infrastructure, the actor can intercept metadata, identify traffic patterns, and potentially deanonymize users. The group shows no preference for specific sectors or countries, focusing instead on the Tor network itself, which indicates a broad interest in digital privacy threats and network reconnaissance.

KAX17 has operated extensively within the Tor network, establishing and maintaining hundreds of malicious relays since at least 2017. These nodes function primarily as entry and middle points, enabling the actor to collect metadata on Tor users and reconstruct network traffic patterns. The group's focus on Tor infrastructure indicates an interest in undermining the anonymity Tor provides, potentially for surveillance or intelligence-gathering purposes. Notably, KAX17 has demonstrated persistence, continuing operations despite efforts by the Tor Project and law enforcement to dismantle their infrastructure. This resilience suggests advanced operational capabilities and a clear strategic objective of long-term network monitoring.

Key Capabilities

• Deployment and maintenance of large-scale Tor relay networks
• Traffic monitoring and metadata collection via Tor nodes
• Network mapping and route reconstruction techniques
• Resilience against infrastructure takedowns
• Use of custom tools for Tor node management and data exfiltration

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

KAX17 has maintained a low operational tempo focused on long-term Tor infrastructure exploitation since 2017. Campaigns involve deploying malicious Tor relays to monitor user traffic and map network routes. The actor's persistence highlights an emphasis on sustained surveillance rather than short-term disruptive goals. Notable operations include repeated reestablishment of Tor nodes after takedowns, suggesting access to resources for rapid redeployment.

IOC Patterns

• Malicious Tor relay IP ranges
• Unusual SSL certificate configurations on Tor nodes
• Abnormal traffic patterns from Tor entry/exit relays
• Suspicious domain registrations linked to Tor infrastructure
• Unusual relay node configurations (e.g., high bandwidth, low latency)

Recommended Actions

• Monitor Tor network traffic for anomalies in relay node behavior
• Implement network traffic analysis tools to detect unexpected data flows
• Collaborate with the Tor Project to report suspicious relay nodes
• Enhance firewall rules to block known malicious Tor exit node IP ranges
• Deploy intrusion detection systems tuned to detect custom C2 protocols

Suggested Tags