Kaspersky said that according to its tests, "OnionPoison" targets victims located in China because its C2 server checks whether the external IP address of the victim's machine is from China. Kaspersky reminded Chinese users to check whether the Tor browser they use is downloaded from the official one.