JDY/KV-Botnet Node Re-Enrollment via Tor C2 Ports from Internal Edge Device

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects outbound TCP traffic destined for known Tor relay ports (9001 and 9030) originating from internal RFC 1918 address space. This behavior is indicative of compromised edge devices or IoT hardware attempting to establish command and control (C2) communication via the Tor network, a tactic commonly used by threat actors to obfuscate their infrastructure and C2 traffic.