NBLock Ransomware Outbound TCP to Tor Relay Ports 9001/9030

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

This rule detects outbound TCP traffic from internal network hosts to known Tor relay ports (9001, 9030), which is a common communication pattern for the NBLock ransomware strain to establish a command and control channel through the Tor network.