Its operators are unknown and its motives seems to be multi-purpose.
[1] In late 2013 the Tor anonymity network saw a very sudden and significant increase in users, from 800,000 daily to more than 5,000,000.
A botnet was suspected and fingers pointed at Mevade.
Trend Micro reported that its Smart Protection Network saw a tor module being distributed to Mevade Trojans.
This malware-related article is a stub.