The Ebury botnet that's been around for a decade now is likely spying on Tor exit ssh tunnels looking for other criminals logging into their h4xxr jump boxes, ransomware deployments they can intercept and exploit themselves, financial crime market operators, crypto drug dealers etc.