Skip to content
brandefense.io
Request A Demo
UnclassifiedUnknown

KAX17

KAX17 is a threat actor group, tracked by Brandefense.

Request IOC feedRequest ATT&CK export
Techniques
0
Exploited CVEs
No CVE data
First seen
Jan 1, 2017
Record updated

About KAX17.

KAX17 is a sophisticated threat actor that has been active since at least 2017. They have operated hundreds of malicious servers within the Tor network, primarily as entry and middle points. Their main objective appears to be collecting information on Tor users and mapping their routes within the network. Despite efforts to remove their servers, KAX17 has shown resilience and continues to operate.

Last updated Oct 9, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.