333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email
Archived — this story has rotated out of today’s deck. It is kept here in full.
The gist
Attackers hijacked 333 Tor exit nodes over three days in October, redirecting SSH traffic to 12 interception servers.
The Ebury backdoor was used; how far the campaign spread remains unclear.
Background
Tor is a network that routes traffic through volunteer-run relays, and exit nodes are the last hop where traffic leaves for the open internet. According to Tor volunteer Kaba, who investigated the campaign with a script and honeypot, the hijacking began in late August when an attacker used a reused valid password to reach a Tor management server and installed Ebury 1.8.3, a Linux backdoor and credential stealer first discovered 12 years ago. The Tor Project's health team said the attacker gained access to Linux-based hosts and edited the torrc configuration file on some servers to turn non-exit relays into exits. The campaign ran October 2–5 and the Tor Project shut it down within days; a detailed researcher account followed in late October.
How it unfolded
- Aug 2026Attackers used a reused valid password to access a Tor management server and installed Ebury 1.8.3, an OpenSSH backdoor and credential stealer, according to Tor volunteers.
- Oct 2, 2026 09:35The hijacking campaign began; Kaba says his own SSH connection was redirected to an interception server that Friday morning.
- Oct 2, 2026 –5, 2026The hijacking of 333 exit nodes took place over these three days.
- Oct 20, 2026A researcher's detailed account of the campaign was published.
- Oct 21, 2026Cyber Security News and securityonline.info published reports on the hijacking.
- Oct 22, 2026Ars Technica reported the findings, including how many exit nodes were compromised and how SSH traffic was redirected.
Who’s saying what
- Expert
- Tor volunteer Kaba said users on an infected exit node notice nothing at first: encrypted web traffic is forwarded as usual, but SSH connections over Port 22 are silently redirected to one of 12 interception servers.
- Official
- The Tor health team said the attacker appeared to be gaining access to Linux-based hosts and edited the torrc file on some servers to turn non-exit relays into exits.
Still unverified
Investigators have not established how the attackers gained control of all the underlying servers, and it is unclear whether any attempts to downgrade traffic and obtain unencrypted email succeeded. Investigators also could not find, for unknown reasons, the RSA key used to connect to Switzerland2 among its authorized keys.