IronWorm Tor C2, .onion DNS, npm Self-Propagation & Git Identity Spoofing

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects behavior associated with the IronWorm threat, including Tor-based command and control communication by unsigned binaries or Node.js processes, unauthorized DNS resolution of .onion domains, automated npm package management operations by Node.js, and git configuration modifications attempting to impersonate common developer automation identities.