Volt Typhoon JDY Botnet Tor C2 Egress from SOHO/Edge Devices (T1090.003)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects outbound network traffic from internal IP addresses to known Tor network entry or exit relay ports (9001, 9030, 9050, 9051). It specifically prioritizes alerts where the source host is identified as network infrastructure (routers, gateways, firewalls) or IoT devices, flagging potential unauthorized use of Tor for obfuscated communication or data exfiltration from within the network perimeter.