Nusenu, which itself is the Tor node operator, discovered malicious activity in 2019 but says KAX17 has been in effect since at least 2017. According to Nusenu, malicious servers with no contact information were added to the Tor network on an ongoing basis, with hundreds of them. At its peak, the network included over 900 malicious servers.
In general, servers added to the Tor network must contain contact information (such as an email address) so that Tor administrators or law enforcement agencies can contact node operators in the event of misconfiguration or reports of abuse. Despite this rule, servers without contact information are often added to the network, mainly to maintain their numbers.
KAX17 servers are located in data centers around the world and are mainly configured as exit and intermediary nodes, with only a small number of them operating as exit nodes. As Nusenu notes, this is strange enough, since most attackers who manage malicious nodes configure them as exit nodes, which allows them to modify traffic. For example, the BTCMITM20 group managed a network of thousands of malicious exit nodes to attack users visiting cryptocurrency-related sites.
According to the researcher, KAX17 collects information about users connecting to the Tor network and then determines their routes. Nusenu reported its findings to the Tor Project last year, and the servers were removed from the network in October 2020. Soon after, another group of exit nodes appeared in Tor with no contact information, but whether it was associated with KAX17 is unclear.
In October and November 2021, the Tor Project also removed hundreds of KAX17 servers. Neither Nusenu nor the Tor Project has speculated yet on who is behind KAX17.