Defending Against Malicious Cyber Activity Originating from Tor

TLP: WHITE

Product ID: A20-183A

July 1, 2020

TLP:WHITE

Defending Against Malicious Cyber Activity

Originating from Tor

This advisory—written by the Cybersecurity Security and Infrastructure Security Agency (CISA) with contributions from the Federal Bureau of Investigation (FBI)—highlights risks associated with Tor, along with technical details and recommendations for mitigation. Cyber threat actors can use Tor software and network infrastructure for anonymity and obfuscation purposes to clandestinely conduct malicious cyber operations.1,2,3

1 CISA Alert published April 2020: Continued Threat Actor Exploitation Post Pulse Secure VPN Patching. Cyber threat actors used Connection P…