--- id: CP-234 slug: tor-deep-web-vs-dark-web lang: en title: Tor, Deep Web and Dark Web description: How Tor and onion routing work, and why an employee should not install Tor on a work computer without the IT department's approval. canonical_url: https://startbrain.io/cyberpedia/en/articles/tor-deep-web-vs-dark-web/ markdown_url: https://startbrain.io/cyberpedia/en/articles/tor-deep-web-vs-dark-web.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Tor, Deep Web and Dark Web", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/tor-deep-web-vs-dark-web/ (CC BY 4.0) wing: 3 theme: browse_safely reflex: cr-077 schema: G3 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/tor-deep-web-vs-dark-web/ fr: https://startbrain.io/cyberpedia/fr/articles/tor-deep-web-dark-web/ de: https://startbrain.io/cyberpedia/de/articles/tor-deep-web-dark-web/ es: https://startbrain.io/cyberpedia/es/articles/tor-deep-web-dark-web/ sources: - "n": 1 title: Tor publisher: MITRE ATT&CK url: https://attack.mitre.org/software/S0183/ accessed: "2026-11-03" - "n": 2 title: "Proxy: Multi-hop Proxy" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1090/003/ accessed: "2026-11-03" - "n": 3 title: Encrypted Channel publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1573/ accessed: "2026-11-03" - "n": 4 title: Proxy publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1090/ accessed: "2026-11-03" - "n": 5 title: "Application Layer Protocol: Web Protocols" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1071/001/ accessed: "2026-11-03" --- # Tor, Deep Web and Dark Web Tor is software and a network used to make browsing more anonymous. Its name often comes up alongside "Deep Web" and "Dark Web", two expressions that are easily confused. This page explains how Tor works and what it changes for a company. The sources gathered here come from the MITRE ATT&CK knowledge base, which describes attacker techniques. They mostly say how Tor is misused, and little about its ordinary use. This page sticks to what they establish. ## In 30 seconds - Where it happens: malicious groups use Tor for their traffic [1]. - What the attacker wants: to hide the origin of their traffic, so that the company cannot trace it back to them [2]. - The reflex: do not install Tor on a work computer without the IT department's approval, and do not download any "Tor browser" from a source the IT department has not confirmed. - If it is already done: tell the IT department right away, without deleting anything on your own. ## Straight answers ### What is Tor? MITRE ATT&CK describes it as a software suite and a network that provide increased anonymity on the Internet. It creates a chained network of relays (a "multi-hop proxy") and uses layered encryption to protect both the message and the routing information [1]. It exists for Linux, Windows and macOS [1]. ### What does "onion routing" mean? Messages are encrypted with several layers. At each step of the relay network, the top layer is decrypted and the content is passed to the next node, until the destination [1]. The image is that of an onion from which each relay removes a layer. ### How many relays does the traffic go through? The source says the traffic is passed through several nodes before leaving the Tor network and continuing to its destination [1]. It gives no number. The figure of three relays, often quoted, does not appear in the sources cited here. ### Is the Dark Web illegal? None of the sources cited here deals with the legal status of the Dark Web or of Tor. This page therefore does not settle the point. The sources establish a different fact: malicious groups use Tor [1]. ### What is the difference between the Deep Web and the Dark Web? The sources cited here define neither of these terms. They only describe Tor, an anonymizing network. For the distinction between non-indexed content and services reached through an anonymizing network, the company's IT department remains the contact. ## How it works Tor combines two mechanisms. The first is the multiple hop: the traffic goes through several nodes before reaching its destination [1]. The second is encryption: Tor encapsulates the traffic in several layers of encryption and uses TLS by default [1]. For a security team, the effect is as follows. Usually, a defender can identify the last proxy the traffic went through before entering their network. They may or may not identify the earlier proxies [2]. Chaining several proxies forces the defender to follow the traffic from relay to relay to find its source [2]. MITRE cites the publicly accessible Tor network as an example of an onion routing network [2]. For the command-and-control communications of malware, MITRE notes that, despite a secure algorithm, an implementation can be vulnerable to reverse engineering if secret keys are hard-coded or generated in the malware samples or their configuration files [3]. Attackers also use proxies to avoid direct connections to their infrastructure, to manage their command-and-control communications, or to take communication paths already considered trusted, so as to avoid suspicion [4]. ## What you do - Do not install Tor, or any anonymization software, on a work computer without the IT department's approval. - If some information seems to be reachable only this way, ask the IT department instead of looking for it yourself. - If a message offers to sell you, show you or have you check company data on a site of this kind, do not click and report it to the IT department. - If you have already installed such software, tell the IT department, even if nothing seems abnormal. ## Pitfalls Believing in absolute anonymity is the first. Encryption and relays complicate a defender's work: MITRE speaks of difficulty in identifying the source, not of impossibility [2]. Tor also serves attackers. MITRE mentions onion networks used to carry encrypted command-and-control traffic through a set of compromised machines [2]. An attacker's traffic can also blend into ordinary web traffic: HTTP/S and WebSocket are very common in corporate environments, and an attacker can hijack them to imitate normal traffic [5]. The network hosts sites run by criminal groups. Water Galura runs a data leak site hosted on Tor for the Qilin ransomware and its affiliates [1]. The ShinyHunters group used Tor for its own leak site [1]. Seeing a company's name on such a site does not by itself prove an attack: verification is up to the IT department. The sources deal neither with fake Tor browsers, nor with booby-trapped downloads, nor with offers of stolen data. The caution requested on these points comes from the IT department's instructions, not from a fact established here. One case does illustrate the risk of software installed without checks: the Dok malware downloads and installs Tor via Homebrew [2]. ## Real cases ### 2025 Poland Wiper Attacks During the 2025 wiper attacks in Poland, the attackers used Tor nodes for their command and control [1][2]. In the CostaRicto campaign, the attackers managed command servers via Tor [1]. ### Scattered Spider and Salesforce data extraction According to MITRE, the Scattered Spider group used Tor to communicate with the targeted organizations [1]. During the Salesforce Data Exfiltration campaign, the attackers used Tor IP addresses for voice calls and data collection [1]. ### Operation Wocao During Operation Wocao, the attackers used Tor exit nodes to run commands [1]. ## Sources 1. MITRE ATT&CK, "Tor". https://attack.mitre.org/software/S0183/ (accessed 3 November 2026) 2. MITRE ATT&CK, "Proxy: Multi-hop Proxy". https://attack.mitre.org/techniques/T1090/003/ (accessed 3 November 2026) 3. MITRE ATT&CK, "Encrypted Channel". https://attack.mitre.org/techniques/T1573/ (accessed 3 November 2026) 4. MITRE ATT&CK, "Proxy". https://attack.mitre.org/techniques/T1090/ (accessed 3 November 2026) 5. MITRE ATT&CK, "Application Layer Protocol: Web Protocols". https://attack.mitre.org/techniques/T1071/001/ (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/tor-deep-web-vs-dark-web/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.