You would think they’d choose a good one.

I also recently wrote a single ephemeral socks5 proxy over a hidden service in Rust. Since they’ve probably compromised other machines in the past, they could’ve easily used something similar to proxy their connection through tor and to some random computer (access some vulnerable router through tor, proxy through it, etc). Hiding your tracks aren’t hard

I think we can safely assume they did not use one of those.