iirc IC still mostly uses burner shell companies for IPs, at least for running ops. Tor is fine for innocuous browsing but Tor exit nodes will stick out like a sore thumb in the victim's logs or IDS.
I'm not someone who looks at a lot of server logs, but what characterises entries as being from Tor?