APT28 Outbound Connections to Tor Network Relay Ports

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•4

This rule identifies outbound network connections from devices to public IP addresses using ports commonly associated with the Tor network (9001, 9030, 9050, 9051). These ports are frequently used for Tor relay, bridge, and control functionality, and connections to them from managed endpoints may indicate unauthorized use of the Tor network for anonymity or malicious command-and-control communication.