{
  "family": "tordev",
  "sample_count": 32,
  "category": "botnet",
  "description": "TorDev (tracked across security intelligence databases and antimalware engines under signatures including Trojan:Win32/TorDev, Backdoor:Win32/TorDev, and Trojan.TorDev) is a stealthy Windows trojan, proxy botnet client, and backdoor active since 2016. Engineered to abuse the Tor onion-routing network to establish anonymous command-and-control communication, TorDev bundles or dynamically downloads an embedded Tor client binary (tor.exe) along with customized Tor configuration files (torrc). Once running on an infected system, TorDev establishes a local SOCKS5 proxy listener (typically on localhost:9050 or localhost:9150) and connects out to attacker-controlled Tor hidden services (.onion addresses). By channeling commands and exfiltration through the Tor darknet, TorDev conceals attacker infrastructure from IP reputation blacklists and perimeter firewall blocks, empowering threat actors to execute remote interactive commands, exfiltrate stolen host telemetry, and rent compromised endpoints as residential proxy exit nodes.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/TorDev",
    "Backdoor:Win32/TorDev",
    "Trojan.TorDev",
    "Win32/TorDev",
    "TorDev Proxy Botnet"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/TorDev?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "TorDev is a Windows trojan and proxy botnet client that uses the Tor network for anonymous command-and-control communication and residential proxy relaying."
      }
    },
    {
      "@type": "Question",
      "name": "How does TorDev use the Tor network on compromised endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It deploys an embedded Tor binary and configuration to route traffic through Tor onion services, masking the operator's actual IP address."
      }
    },
    {
      "@type": "Question",
      "name": "What malicious actions can attackers execute via TorDev?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Attackers can run arbitrary shell commands, exfiltrate files, download secondary malware, and route external cybercrime traffic through the host as a proxy."
      }
    },
    {
      "@type": "Question",
      "name": "How does TorDev achieve persistence?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It installs background Windows services and writes autorun entries to the Windows CurrentVersion\\Run registry key."
      }
    },
    {
      "@type": "Question",
      "name": "How can network administrators detect TorDev proxy activity?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Monitor for unauthorized outbound connections to known Tor directory authorities and detect processes listening on local ports 9050 or 9150."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1090.003",
    "T1071.001",
    "T1059.003",
    "T1547.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Trojanized Software Keygens",
    "Phishing Emails with Obfuscated Loaders",
    "Deceptive Torrent Downloads"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Server"
  ],
  "capabilities": [
    "Embedded Tor Onion-Routing Proxy Client",
    "Hidden Service (.onion) C2 Communication",
    "Local SOCKS5 Proxy Server Spawning",
    "Remote Command Execution via cmd.exe",
    "Encrypted Data Exfiltration over Tor"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Embedded Tor Client (tor.exe)",
      "Tor Configuration File (torrc)"
    ],
    "network_signatures": [
      "Outbound TLS connections to dynamic Tor directory authorities and guard relay nodes on ports 9001/443",
      "Localhost TCP listening ports (127.0.0.1:9050/9150) accepting internal SOCKS proxy requests"
    ],
    "evasion_techniques": [
      "Masquerading the tor.exe process under legitimate names like svchost.exe or taskhost.exe",
      "Concealing onion routing configuration files inside %ProgramData% or %AppData% with hidden directory attributes"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c",
      "4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\TorDevSvc",
      "HKLM\\SYSTEM\\CurrentControlSet\\Services\\TorDevService"
    ],
    "file_paths": [
      "%AppData%\\TorDev\\tordev.exe",
      "%AppData%\\TorDev\\tor.exe",
      "%AppData%\\TorDev\\torrc"
    ]
  },
  "defensive_measures": [
    "Block outbound connections to known Tor guard relays and directory authorities using threat intelligence IP feeds",
    "Monitor endpoints for processes binding to localhost SOCKS proxy ports (9050, 9150)",
    "Deploy application control policies to block unauthorized executions of tor.exe or bundled Tor libraries"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/TorDev",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/TorDev"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Backdoor.Win32.TorDev",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Trojan:Win32/TorDev.A",
      "Backdoor:Win32/TorDev.B"
    ]
  },
  "motivation": "Anonymous Remote Control, Darknet Proxy Relaying & Data Exfiltration",
  "sample_hashes": []
}