Crypto-ransomware – in January of 2015, the Australia-New Zealand region was afflicted by variants of TorrentLocker, a ransomware variant that uses encryption to extort money from victims. The malware uses TOR for its payment page, so that transactions wouldn’t be hindered if authorities try to bring down their payment servers.
ZBOT – a well-known online banking malware that targeted 64-bit systems. The malware leverages TOR to evade C&C communications, including anti-malware solutions.
BIFROSE – known for its keylogging routines, BIFROSE is a variant of a backdoor malware that is capable of stealing far more information than just keystrokes. Known to be widely available in the cybercriminal underground, BIFROSE enables the attacker to log into internal systems and send messages to other users in the network.
Android ransomware – this malware shows a screen that notifies the user that their device has been locked down, and that they need to pay a ransom in order to recover their data. Failure to pay would result in the destruction of all data in the mobile device. Like the above-mentioned cases, it uses TOR to communicate with its C&C server.