Nothing new there. We've been dealing with bad guys coming through TOR nodes for at least 1.5 years.
What annoys me more is the people using AWS to send us bad traffic.
Is there no reporting for AWS?
It's whack-a-mole, basically. Amazon has not been too keen on dealing with abuse reports that I've seen, and even then, criminals setting up botnets and exits on AWS are almost certainly using stolen identities.