CryptoBandits Local Tor Proxy via Curl

Luís Marques@remotecodeexecution

•updated Jun 22, 2026•0•0•4

Detects the usage of curl.exe routing traffic through a local SOCKS5 proxy on port 9050, a behavior observed in CryptoBandits malware communicating with a bundled Tor client to hide its Command and Control (C2) destination.