333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email
ars ·
In late August and early October 2026, unknown hackers compromised 333 Tor exit nodes to intercept sensitive data. The attack began when an intruder used a reused password to access a Tor management server and installed the Ebury backdoor on Linux systems. From there, the attackers gained control of a second server named Switzerland2 and reconfigured numerous exit relays. They redirected SSH traffic through Port 22 to twelve attacker-controlled servers, capturing passwords from users who ignored host key warnings. Simultaneously, the hijacked nodes blocked encrypted email ports while allowing unencrypted connections, enabling the theft of plaintext messages. A Tor volunteer identified the compromise by polling exit nodes and setting up honeypots to observe the malicious activity. Investigators suspect a financially motivated crime group is behind the incident, though the exact method for controlling so many servers remains unclear. The event highlights the importance of defense-in-depth measures, such as disabling password authentication for SSH and enforcing encrypted email protocols.
ars