Security researchers at Fox-IT firm found evidence that spike in Tor traffic is caused by a Mevade botnet that hides its C&C in the anonymizing network.