logoalt Hacker News

Maxioustoday at 1:42 PM0 repliesview on HN

Possibly via compromised php sites with webshells on AWS and DigitalOcean they could run shell commands to install and use Tor. We don't have forensics of the AWS/DigitalOcean sites although maybe can find signs using shodan etc.