Tor Network Abused for IoT Device Exploits

In a stark revelation of the darker side of online anonymity, researchers have uncovered a sophisticated campaign leveraging the Tor network to exploit vulnerabilities in cloudless Internet of Things (IoT) devices. The findings, presented at Black Hat Asia 2026, expose a silent global infiltration targeting millions of devices, turning Tor's privacy-enhancing features into a tool for cybercrime.

The "Torchlight" System Uncovers a Hidden Threat

Yuming Japan, a PhD student from Southeast University, along with his co-authors, introduced "Torchlight," a system designed to collect, discover, and analyze IoT attacks occurring at Tor exits. The research highlights how attackers exploit Tor's anonymity to exploit zero-day vulnerabilities against cloudless IoT devices, a category that includes high-capacity devices like Network Attached Storage (NAS) units and Digital Video Recorders (DVRs).

These devices, unlike traditional cloud-centric IoT gadgets, are directly exposed to the internet and often lack robust security measures. The researchers observed anomalous traffic patterns targeting these devices on their Tor exit routers, prompting a deeper investigation. "Why would a benign user accept the latency and complexity of a three-hop anonymous circuit just to check their own home camera? It just doesn't make sense," Japan stated, underscoring the suspicious nature of the observed traffic.

Exploiting Vulnerabilities Through Anonymity

The study revealed that attackers are weaponizing Tor's anonymity to exploit zero-day vulnerabilities, often through techniques like command injection and path traversal. Examples presented included attacks that leaked device credentials in plain text and attempted to implant backdoors by injecting URL-encoded commands, making them difficult for traditional intrusion detection systems to detect.

The Torchlight system comprises three main components: a Tor exit traffic collector, a deployment planner, and an LLM-based IoT traffic analyzer. The collector captures external Tor traffic, the deployment planner optimizes the allocation of resources, and the LLM-based analyzer processes the vast amounts of data to identify IoT traffic and confirm attacks using a five-step chain-of-thought process.

A Silent Global Infiltration Campaign

Over a 12-month period, the research team deployed three exit routers, collecting approximately 26 terabytes of traffic. Their analysis uncovered traffic from over 50,000 unique IoT devices across 148 countries. Digital Video Recorders (DVRs) and cameras were found to be the prime targets, accounting for 90% of identified devices, with brands like Qualvision, TVT, and Hikvision being particularly vulnerable.

The findings also revealed that the majority of traffic involved failed password cracking attempts, with attackers often researching device-specific credentials and factory defaults. This indicates a meticulous approach to reconnaissance before launching exploits.

Significant Findings and Broader Implications

Torchlight successfully identified 45 vulnerabilities, including 29 zero-day exploits with 25 CVE numbers assigned, 14 of which were classified as critical. The estimated market value of these vulnerabilities was over $300,000, highlighting their significance. More alarmingly, the research estimates that these vulnerabilities affect approximately 12 million devices exposed online.

The team also tracked exploitation attempts, detecting over 90,000 instances targeting specific vulnerabilities over 12 months. The study noted a disturbing trend of vulnerability clustering in devices from brands like D-Link, Faraday, Shungai, and TBK, where multiple vulnerabilities interact to grant attackers full control.

A Call for Proactive Defense

The research team emphasized the ethical complexities involved, ensuring no personally identifiable information was inspected and that data was kept secure. They also recommended that future researchers consult the Tor Research Safety Board.

The discovery of these vulnerabilities and their active exploitation within the Tor network underscores a critical need for proactive IoT defense strategies. The findings were also noted by CISA, which added three of the identified vulnerabilities to its Known Exploited Vulnerabilities Catalog.