Using ifenslave on two endpoint Linux servers, it's possible to aggregate (aka bond or team) multiple tun or tap interfaces (e.g., tun0, tun1, ...) into a single link, combining bandwidth (less overhead) and improving reliability. SSH or OpenVPN can provide requisite tun interfaces, and either can be routed through Tor between hidden services.
Four questions come to mind:
- Would this work?
- If it would, how many such tun interfaces could be aggregated?
- Might this be what all those Mevade bots are doing?
- Is this hypothesis about Mevade testable?
With six OnionCat links and MPTCP, I can transfer (bbcp) at ~50 Mbps. With multiple targets, source servers can push ~200 Mbps. It's obviously not very anonymous. But it's probably more anonymous than using VPN services. That's for servers with gigabit uplinks, by the way. Methods are here.
If you're going to be eating up relay bandwidth, it's only fair to contribute. There's little risk or hassle in running entry guards or bridges, and middle relays. Each of the OnionCat links uses two of each. Or you could contribute to TorServers.