What even is "malicious tor traffic"? If I was doing any botnet spam stuff, I would definitely not use Tor.
It's not useful for doing DoS or spamming. It's not useful for targetted attacks due to how blocked tor traffic gets. Who is useful Tor for cyberattacks?