While I wouldn't want to speculate on if this number is correct or not, I do agree that such is the industrialisation of cybercrime today faced by businesses, governments and consumers, that relatively small numbers of common exploits and cybercrime tools are widely used by the professional gangs operating around the world.
Despite 'snake oil' claims from many security product vendors, there are no silver bullets and security is no longer simply a question of building up the walls around your business, you need to have threat visibility across your entire enterprise and deal directly with the issue quickly and efficiently. Only by deploying a solution to execute on the entire lifecycle of the threat can you ensure you are protected before, during and after the attack.
Tor (short for The Onion Router) is software designed to allow someone to remain anonymous when accessing the Internet. It has been around for some time, but for many years was used mainly by experts and enthusiasts. However, Edward Snowden's revelations have resulted in a surge of interest in Tor as more people seek online anonymity.
Cybercrime today is not like the early days of virus writers and hackers who bragged about their exploits with friends. Today cybercrime is a serious business where actually most hackers do not want to be noticed as the longer they remain hidden in the network and are free to conduct their operations, the more information they can steal and the more money they can make.