{
  "family": "tordev",
  "sample_count": 32,
  "category": "trojan",
  "description": "Trojan:Win32/Tordev is a heuristic detection for malicious software that leverages the Tor anonymity network (The Onion Router) to completely obfuscate its Command and Control (C2) communications, making it exceptionally difficult for defenders to track the origin of the threat actors or block the infrastructure.<br><br><b>Understanding Tordev</b><br>To the victim, the malware operates invisibly. However, for a network defender, Tordev represents a significant challenge in attribution and containment. Instead of reaching out to a standard, hardcoded IP address or domain name (which could easily be blocked by a corporate firewall), Tordev routes its traffic through a series of encrypted Tor nodes. The ultimate destination is usually a hidden service (a `.onion` address) hosted on the Dark Web.<br><br><b>Execution and Evasion Strategies (The Tor Hidden Service)</b><br>Tordev variants are distributed via standard mechanisms (spearphishing, exploit kits). Upon execution on the victim machine, the malware often drops a legitimate, bundled version of the `tor.exe` client (`T1105`), or it contains a statically linked Tor library (like `libtor`). It launches the Tor process silently in the background, binding it to a local port (e.g., `127.0.0.1:9050`). The malware then proxies all its exfiltration data, command requests, and payload downloads through this local Tor proxy (`T1090.003`). Because the traffic leaving the corporate network is encrypted Tor traffic, standard IDS/IPS systems cannot inspect the payload, and DNS blackholing is entirely ineffective.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is highly secure, untraceable data exfiltration or remote control. EDR platforms should flag any unauthorized execution of `tor.exe` or unrecognized processes establishing persistent connections over typical Tor ports (TCP 9001, 9030). Network edge devices (firewalls) will show encrypted traffic destined for known Tor entry nodes. The presence of Tor configuration files (`torrc`) in unexpected directories (like `%AppData%`) is a definitive IoC.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1055",
    "T1573.002",
    "T1090.003",
    "T1105",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1090.003",
      "name": "Proxy: Multi-hop Proxy",
      "tactic": "Command and Control"
    },
    {
      "id": "T1573.002",
      "name": "Encrypted Channel: Asymmetric Cryptography",
      "tactic": "Command and Control"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network; the attacker has a highly secure, encrypted channel directly into the affected machine.",
    "Ensure that corporate firewalls are configured to block all traffic to and from known Tor entry, exit, and relay nodes.",
    "Identify the malicious process interacting with the Tor proxy and terminate it via EDR response actions.",
    "Capture a memory dump before rebooting to extract the malware and potentially the `.onion` address it was attempting to contact."
  ],
  "what_to_avoid": [
    "Do not assume your edge firewall will catch the malicious payload; Tor encrypts the payload so deep packet inspection (DPI) fails.",
    "Avoid allowing users to run unauthorized VPNs or proxy tools, as this masks the deployment of Tordev-like malware."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}