A mysterious threat actor has been operating hundreds of malicious TOR relay nodes within several entry, middle-ground, and exit servers since 2017. This threat actor, tracked as KAX17, consistently configured these TOR nodes with no contact details, which is commonly how TOR servers are configured in case of misconfiguration, abuse reports, or law enforcement involvement. Security researchers believe that KAX17 is conducting information collection on users who access these relay nodes. At KAX17’s highest points, the average user would have a 16% chance of connecting to an entry node, 35% chance of passing through a middle-ground relay, and a 5% chance of hitting an exit node, all of which being operated by the threat actor. Despite filing abuse claims on hundreds of these nodes, more nodes are spun up once the others are taken down. Based on the activity of KAX17, this is a nation-level threat actor with a significant revenue flow to support hundreds of high-spec servers, with no financial return from them. CTAPT will continue to monitor any significant movements from this threat actor and provide updates accordingly.