Volt Typhoon JDY/KV-Botnet C2 via Tor Ports 9001 and 9050

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•6

Detects outbound network connections to common Tor relay and exit ports (9001, 9050) initiated by processes other than authorized Tor clients. This activity is often associated with threat actors, including Volt Typhoon, using Tor to obfuscate command-and-control (C2) traffic.