iirc IC still mostly uses burner shell companies for IPs, at least for running ops. Tor is fine for innocuous browsing but Tor exit nodes will stick out like a sore thumb in the victim's logs or IDS.

I'm not someone who looks at a lot of server logs, but what characterises entries as being from Tor?

Being on the list of TOR exit nodes: https://www.dan.me.uk/tornodes