Operation Onion Skin

TRACE · LINUX · difficulty 3 · ~28 min · 13 steps

Every hop is Tor. Route attribution is dead — so establish why they came for you.

Briefing

Nine days of intrusion into your customer portal. Every connection came from a different Tor exit relay. There is no next hop to chase: Tor is built so the entry side cannot be recovered from the exit side, and no amount of whois will change that. So stop asking WHO and start establishing WHY. Tor hides the route. It does not hide when they worked, what client they brought, what they reached for first, or how they found you. Those four things tell you whether this was opportunistic or aimed — and that answer is what actually changes your defences on Monday.

Objectives

• Prove the network trail is exhausted, and understand why
• Extract what Tor does NOT conceal: timing, client, operational slips
• Establish targeting — were you chosen, or merely reachable
• Write a victimology assessment that changes what you defend

Return to the range lobby