Tor 101: How Tor Works and its Risks to the Enterprise
Summary: Unit 42 reports that in one month it observed 6,617,473 Tor sessions to or from 691 devices across 204 customer networks, and advises enterprises to block Tor traffic. The article explains that Tor's onion routing encrypts data in three layers across a guard, middle relay and exit node, so no single node knows both the sender and the destination.
What's compelling: The same tool that protects political activists also carries malware command and control, data exfiltration and hidden reconnaissance, and Unit 42's own telemetry shows millions of Tor sessions already crossing customer networks. Employees can also use Tor to bypass content filtering and geographic restrictions, which means your URL filtering stops working the moment a user opens a Tor circuit.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026