Security researchers have identified a botnet controlled by its creators over the Tor anonymity network. The botnet is called Skynet and can be used to launch DDoS (distributed denial-of-service) attacks, generate Bitcoins. Botnet’s command and control (C&C) servers are only accessible from within the Tor network using the Tor Hidden Service protocol. It’s likely that other botnet operators will adopt this approach, according to the team from vulnerability assessment and penetration testing firm Rapid7.”]
Source: https://www.csoonline.com/article/2132642/tor-network-used-to-command-skynet-botnet.html