What recent real-world attacks or academic studies (post-2020) demonstrate practical deanonymization of hidden services?

1. Academic flow‑correlation and fingerprinting: renewed, practical attacks

Recent peer‑reviewed work has advanced flow‑correlation into attacks tailored to onion services: the NDSS 2024 paper introduces SUMo, a sliding‑subset‑sum flow‑correlation method the authors present as effective and efficient at deanonymizing onion‑service sessions, and they analyze countermeasures for Tor ^[1]. Earlier related academic work (circuit fingerprinting) demonstrated that an adversary controlling or observing an entry/guard can classify rendezvous/circuit types and link hidden‑service traffic with high accuracy; reporting on such fingerprinting (including MIT‑affiliated research) claimed high certainty in classifying circuits used by hidden services ^{[4] [5]}.

2. Practicality depends on adversary capability and operational detail

Authors and reviewers repeatedly stress that these techniques often require strong capabilities — e.g., control or observation of entry/guard relays, substantial relay resources (Sybil-style presence), or high‑quality passive monitoring — and sometimes active protocol manipulation ^{[6] [7]}. Survey and methodology papers note that while methods exist and have been demonstrated, a “general method” that given an onion service will produce a small set of candidate relays reliably remains an open problem in some settings ^{[8] [9]}.

3. Real‑world law‑enforcement cases: court records and investigative studies

Beyond lab proofs, forensic and court‑document studies have cataloged investigative methods used against onion services in prosecutions: the “Onion Services in the Wild” study reviewed court documents from many cases and models law‑enforcement techniques (including guard discovery, timing correlation, and operational errors) to show these are used in practice during investigations ^{[10] [3]}. Media and security outlets reporting on recent claims say German and other agencies have used timing analysis and guard‑discovery techniques in some takedowns, and Tor Project responses have acknowledged targeted deanonymization incidents tied to outdated client setups and guard‑discovery attacks ^{[11] [12]}.

4. Operational mistakes and application‑level leaks are common attack vectors

Multiple sources emphasize that many successful deanonymizations rely less on breaking Tor’s core crypto and more on misconfiguration, application‑level information leaks, or auxiliary data linking (e.g., leaking real IPs via service misconfiguration, Bitcoin‑address linkage, or correlating uptime with public availability) ^{[13] [14] [3]}. Simioni’s investigative work and webinars demonstrate monitoring/instrumentation strategies that correlate service behavior and public signals to identify service hosts ^{[9] [15]}.

5. Historical attacks and the role of Sybil/relay‑scale operations

Past high‑impact incidents and academic demonstrations show that running many relays (a Sybil approach) or occupying specific positions in Tor’s graph can make deanonymization feasible; repositories and surveys document attacks where adversaries gained enough guard capacity to link users to hidden services ^{[6] [16]}. Tor defenses such as Vanguards, vanguards‑lite, and later protocol hardening aim to reduce guard‑discovery and timing vulnerabilities cited in these studies ^{[7] [12]}.

6. What the sources do not say or leave open

Available sources do not provide a single, universally applicable recipe that an attacker can apply today to deanonymize any onion service without strong resources or operational missteps by the target; several papers explicitly frame deanonymization as feasible under specific assumptions (e.g., control of relays, access to traffic, or exploitable client/service misconfiguration) rather than universally trivial ^{[8] [1]}. Where journalism reports claim broad law‑enforcement capability, Tor Project statements and academic caveats note such attacks are targeted and depend on older client versions or specific conditions ^{[11] [12]}.

7. Practical takeaway for defenders and investigators

Defenders should prioritize eliminating configuration leaks, keep Tor clients and any supporting software (e.g., legacy Ricochet) updated, use Tor‑recommended mitigations like Vanguards/vanguards‑lite, and assume sophisticated adversaries may combine network observation with application‑level signals; investigators and policymakers should recognize both the demonstrated technical methods (flow correlation, fingerprinting, guard discovery) and the legal/ethical complexities when interpreting claims of mass deanonymization ^{[7] [1] [12]}.

If you want, I can compile a short list of the most relevant papers and news items from the set above (NDSS 2024 SUMo, Simioni/IBM 2021, Tor‑dev discuss CVE‑2020‑8516, the “Onion Services in the Wild” court‑document study, and the reporting around 2024 law‑enforcement timing attacks) with direct links and one‑line descriptions for each ^{[1] [2] [7] [10] [11]}.