Frances cyber-crime investigation unit OCLCTIC seized one server running two Tor Relays Investigating the WannaCry attack. Both relays were working as Tor entry guard nodes, key components of Tor routing when users connect the anonymizing network. The server was operated by the French activist Aeris that reported the police’s action through the Tor Project mailing on May 15 asking other Tor operators to revoke trust in the two seized relays. Police seized the server hosted at hosting company Online SAS, because the traffic associated with Wanna Cry ransomware that infected a big French company on May 12 was pointing the two Tor relays.”]
Source: https://securityaffairs.co/wordpress/59955/deep-web/wannacry.html