By leveraging the operational security failures of threat actors and other techniques, Cisco Talos was able to identify TOR hidden services hosted on public IP addresses, some of which were previously unknown infrastructures associated with DarkAngels, Snatch, Quantum and Nokoyawa ransomware groups.