333 Tor Exit Relays Removed After Ebury 1.8.3 SSH Interception

Attackers compromised Linux hosts in August 2026 and deployed Ebury 1.8.3, an OpenSSH backdoor. On October 2 they activated 333 exits to redirect port 22 traffic to 12 interception servers while restricting other ports to capture unencrypted mail. Operators received host key mismatch warnings during SSH attempts; ignoring them allowed password theft, command logging, and secondary infection.

Exitmap scans across all exits confirmed the pattern: a dozen nodes returned forged ED25519 fingerprints matching SHA256:6baCZCPsl+AfQuujUS81fMEE/C7UeJ+AwjrImqmDB3E. Tor Network Health flagged the relays BadExit on October 4, producing a visible drop in exit bandwidth on metrics.torproject.org that persisted after October 5. The attacker later converted some nodes to middle relays before final shutdown.

The incident exposed concentration risk in Tor exits and the speed at which a single credential-stealing campaign can seize 10% of exit capacity. Prior documented Ebury variants targeted hosting providers; this deployment added active traffic manipulation absent from earlier reports. Sustained lower exit diversity increases the feasibility of future targeted interception against remaining operators.

Tor Project documentation now recommends running exits only on dedicated hardware with strict outbound filtering and regular binary integrity checks. Operators who lost nodes face re-entry delays due to the BadExit flag history.