A lot of ransomware and malware uses deep web services to get their key. I was wondering if they carry the Tor browser with them or if they use some other technique, as I don't think everyone has Tor installed on their system.

  • You can't say "the Tor". Tor stands for "the onion router". So you said "the the onion router" Commented Jun 6, 2017 at 2:02
  • @TheValyreanGroup I might have messed up with my edit, but where does it say "the Tor"?
    – Arminius
    Commented Jun 6, 2017 at 2:35
  • The title, and first sentence. connect to the Tor deep web? and if they carry the Tor browser Commented Jun 6, 2017 at 2:38
  • 3
    @TheValyreanGroup This is taken from the Tor website: "...we strongly recommend you use the Tor Browser." So I'm following the official way they use their name.
    – Arminius
    Commented Jun 6, 2017 at 2:44

1 Answer 1


Malware that needs to access a website in the Tor network often employs a Tor2web service.

These free services enable you to connect to an onion site with your regular browser. They provide a gateway to the Tor network over HTTP or HTTPS and connect to Tor themselves. This way, the malware doesn't need to come with a full-blown Tor client.

One of the most popular Tor2web domains is onion.to. You can basically append the .to extension to almost any onion link to access it from the clearnet. E.g., a mirror of The Hidden Wiki can be accessed this way:


While Tor2web is straightforward, there are also cases where ransomware prompts victims to download the Tor browser manually themselves and some malware uses actual Tor components to obscure their C&C communication:

Malware can just as easily use Tor as anyone else. In the second half of 2013, we saw more malware making use of it to hide their network traffic. In September, we blogged about the Mevade malware that downloaded a Tor component for backup command and control (C&C) communication. In October 2013, Dutch police arrested four persons behind the TorRAT malware, a malware family which also used Tor for its C&C communication. [...]

In the last weeks of 2013, we saw some ransomware variants that called itself Cryptorbit that explicitly asked the victim to use the Tor Browser (a browser bundle pre-configured for Tor) when paying the ransom.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .