CryptoBandits Malware Combines Backdoor and Infostealer, Abuses Tor for C2

CryptoBandits is a malware family that blends data-theft and remote code execution capability in a single backdoor. It routes its command-and- control traffic through a local SOCKS5 proxy over Tor, which helps it blend in with legitimate traffic and complicates network-based detection. Defenders should flag unexpected local SOCKS5 proxy processes and outbound Tor connections as indicators worth investigating.