The latest version of Necro turns to Tor C2 and targets both Linux and Windows.

https://blog.netlab.360.com/necro-shi-yong-tor-dong-tai-yu-ming-dga-shuang-sha-windows-linux/