For a year, gang operating rogue Tor node infected Windows executables
What's more, according to a blog post published Friday by researchers from antivirus provider F-Secure, the rogue exit node was tied to the "MiniDuke" gang, which previously infected government agencies and organizations in 23 countries with highly advanced malware that uses low-level code to stay hidden. MiniDuke was intriguing because it bore the hallmark of viruses first encountered in the mid-1990s, when shadowy groups such as 29A engineered innovative pieces of malware for fun and then documented them in an E-zine of the same name. Written in assembly language, most MiniDuke files were tiny. Their use of multiple levels of encryption and clever coding tricks made the malware hard to detect and difficult to reverse engineer. The code also contained references to Dante Alighieri's Divine Comedy and alluded to 666, the "mark of the beast" discussed in the biblical Book of Revelation
I never used TOR, For some reason I never trusted it.