Russian Tor exit node that was claimed to be patching binary files is actually distributing a malware program to launch cyber-espionage attacks against European government agencies. The rogue Russian exit node was banned from the Tor network, but is being used to plant a new variant of the MiniDuke advanced persistent threat (APT) malware. The malware has ability to steal login credentials and system information from the machines it infected, along with ability to evade from antivirus. It also uses hijacked Twitter accounts for Command & Control and located backup control channels via Google searches.
Source: https://thehackernews.com/2014/11/onionduke-apt-malware-served-through_17.html