APT / THREAT GROUP

KAX17

aliases

Last seen:Mar 17, 2026

Intelligence Profile

KAX17 is a sophisticated threat actor that has been active since at least 2017. They have operated hundreds of malicious servers within the Tor network, primarily as entry and middle points. Their main objective appears to be collecting information on Tor users and mapping their routes within the network. Despite efforts to remove their servers, KAX17 has shown resilience and continues to operate.

Threat Analysis

KAX17 is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://www.malwarebytes.com/blog/news/2021/12/was-threat-actor-kax17-de-anonymizing-the-tor-network/amp

→https://therecord.media/a-mysterious-threat-actor-is-running-hundreds-of-malicious-tor-relays

→https://darknetlive.com/post/who-is-responsible-for-running-hundreds-of-malicious-tor-relays/

→https://nusenu.medium.com/is-kax17-performing-de-anonymization-attacks-against-tor-users-42e566defce8

Quick Facts

TypeAPT / Threat Group

Aliases1

SourceMalpedia

Also Known As

KAX17

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search KAX17