Since at least 2017, a mysterious threat actor has run thousands of
malicious servers in entry, middle, and exit positions of the Tor
network in what a security researcher has described as an attempt to
deanonymize Tor users.

---------------

https://therecord.media/a-mysterious-threat-actor-is-running-hundreds-of-malicious-tor-relays/