Individuals and organizations certainly run malicious exit nodes, but there's literally not a hint of evidence in this post to backup the author's claim that these exit nodes are operated by a single group?
If you read between the lines, he gives a few hints with regards to the sslstripping and traffic manipulation on only a limited set of sites.
This is from another post @ https://medium.com/@nusenu/the-growing-problem-of-malicious-...:
> In autumn 2019 I stumbled on something odd: Tor relays doing something that the official tor software is unable to do. This is intentionally vague to avoid giving away the detection methodology to the adversary."
1. Explicit identification. Tor relays, including exit nodes, are identified by contact information. Many of the groups of malicious exit nodes shared contact information.
2. Benign behavioral identification. Many of the identified malicious exit nodes were deployed on the same service providers, including some obscure ones. This isn't a definitive identifier, but it helps link explicitly identified groups.
3. Malicious behavioral identification. Many of the malicious exit nodes were performing similar attacks on outbound traffic, like sslstripping traffic to cryptocurrency web sites. The exact parameters of this behavior (e.g, which sites were targeted, what modifications were made to cleartext data, etc) weren't laid out in the article, but would serve as a highly accurate fingerprint for a specific attacker.