Cyberpediaby Brain
ENDEFR

Tor, Deep Web and Dark Web

How Tor and onion routing work, and why an employee should not install Tor on a work computer without the IT department's approval.

In 30 seconds

Where it happens
Malicious groups use Tor for their traffic1.
What the attacker wants
To hide the origin of their traffic, so that the company cannot trace it back to them2.
The reflex
Do not install Tor on a work computer without the IT department's approval, and do not download any "Tor browser" from a source the IT department has not confirmed.
If it is already done
Tell the IT department right away, without deleting anything on your own.

What it is

Tor is software and a network used to make browsing more anonymous. Its name often comes up alongside "Deep Web" and "Dark Web", two expressions that are easily confused. This page explains how Tor works and what it changes for a company.

The sources gathered here come from the MITRE ATT&CK knowledge base, which describes attacker techniques. They mostly say how Tor is misused, and little about its ordinary use. This page sticks to what they establish.

Straight answers

What is Tor?

MITRE ATT&CK describes it as a software suite and a network that provide increased anonymity on the Internet. It creates a chained network of relays (a "multi-hop proxy") and uses layered encryption to protect both the message and the routing information1. It exists for Linux, Windows and macOS1.

What does "onion routing" mean?

Messages are encrypted with several layers. At each step of the relay network, the top layer is decrypted and the content is passed to the next node, until the destination1. The image is that of an onion from which each relay removes a layer.

How many relays does the traffic go through?

The source says the traffic is passed through several nodes before leaving the Tor network and continuing to its destination1. It gives no number. The figure of three relays, often quoted, does not appear in the sources cited here.

Is the Dark Web illegal?

None of the sources cited here deals with the legal status of the Dark Web or of Tor. This page therefore does not settle the point. The sources establish a different fact: malicious groups use Tor1.

What is the difference between the Deep Web and the Dark Web?

The sources cited here define neither of these terms. They only describe Tor, an anonymizing network. For the distinction between non-indexed content and services reached through an anonymizing network, the company's IT department remains the contact.

1How it works1 min

Tor combines two mechanisms. The first is the multiple hop: the traffic goes through several nodes before reaching its destination1. The second is encryption: Tor encapsulates the traffic in several layers of encryption and uses TLS by default1.

For a security team, the effect is as follows. Usually, a defender can identify the last proxy the traffic went through before entering their network. They may or may not identify the earlier proxies2. Chaining several proxies forces the defender to follow the traffic from relay to relay to find its source2. MITRE cites the publicly accessible Tor network as an example of an onion routing network2.

For the command-and-control communications of malware, MITRE notes that, despite a secure algorithm, an implementation can be vulnerable to reverse engineering if secret keys are hard-coded or generated in the malware samples or their configuration files3.

Attackers also use proxies to avoid direct connections to their infrastructure, to manage their command-and-control communications, or to take communication paths already considered trusted, so as to avoid suspicion4.

2What you do1 min
  • Do not install Tor, or any anonymization software, on a work computer without the IT department's approval.
  • If some information seems to be reachable only this way, ask the IT department instead of looking for it yourself.
  • If a message offers to sell you, show you or have you check company data on a site of this kind, do not click and report it to the IT department.
  • If you have already installed such software, tell the IT department, even if nothing seems abnormal.
3Pitfalls1 min

Believing in absolute anonymity is the first. Encryption and relays complicate a defender's work: MITRE speaks of difficulty in identifying the source, not of impossibility2.

Tor also serves attackers. MITRE mentions onion networks used to carry encrypted command-and-control traffic through a set of compromised machines2. An attacker's traffic can also blend into ordinary web traffic: HTTP/S and WebSocket are very common in corporate environments, and an attacker can hijack them to imitate normal traffic5.

The network hosts sites run by criminal groups. Water Galura runs a data leak site hosted on Tor for the Qilin ransomware and its affiliates1. The ShinyHunters group used Tor for its own leak site1. Seeing a company's name on such a site does not by itself prove an attack: verification is up to the IT department.

The sources deal neither with fake Tor browsers, nor with booby-trapped downloads, nor with offers of stolen data. The caution requested on these points comes from the IT department's instructions, not from a fact established here. One case does illustrate the risk of software installed without checks: the Dok malware downloads and installs Tor via Homebrew2.

4Real cases1 min

2025 Poland Wiper Attacks

During the 2025 wiper attacks in Poland, the attackers used Tor nodes for their command and control12. In the CostaRicto campaign, the attackers managed command servers via Tor1.

Scattered Spider and Salesforce data extraction

According to MITRE, the Scattered Spider group used Tor to communicate with the targeted organizations1. During the Salesforce Data Exfiltration campaign, the attackers used Tor IP addresses for voice calls and data collection1.

Operation Wocao

During Operation Wocao, the attackers used Tor exit nodes to run commands1.

Fact sheet

Identifier
CP-234
Wing
3. Protocols and defence
Brain skill
Safe Web Browsing (browse_safely)
Brain reflex
cr-077
Diagram
G3 · System & Protocol Anatomy
Languages
de, en, fr
Sources
5 sources checked on 3 November 2026
Sources5 sources
  1. MITRE ATT&CK, “Tor”. https://attack.mitre.org/software/S0183/ (accessed 3 November 2026)
  2. MITRE ATT&CK, “Proxy: Multi-hop Proxy”. https://attack.mitre.org/techniques/T1090/003/ (accessed 3 November 2026)
  3. MITRE ATT&CK, “Encrypted Channel”. https://attack.mitre.org/techniques/T1573/ (accessed 3 November 2026)
  4. MITRE ATT&CK, “Proxy”. https://attack.mitre.org/techniques/T1090/ (accessed 3 November 2026)
  5. MITRE ATT&CK, “Application Layer Protocol: Web Protocols”. https://attack.mitre.org/techniques/T1071/001/ (accessed 3 November 2026)

Cite this article

Brain, “Tor, Deep Web and Dark Web”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/tor-deep-web-vs-dark-web/

BibTeX 
@misc{brain_cp234_en_2026,
  author = {Brain},
  title = {Tor, Deep Web and Dark Web},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/tor-deep-web-vs-dark-web/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence