333 Tor Exit Nodes Redirected SSH Traffic via 12 Interceptor Servers October 2-5
333 Tor exit nodes were hijacked for four days in October to capture SSH passwords and unencrypted email. The campaign began with password reuse on a management server and spread via the long-lived Ebury backdoor. The incident reveals systemic credential and key-management failures among volunteer-operated relays.
Attackers gained initial access to a Tor management server in late August using a reused password, then installed the Ebury Linux backdoor first documented in 2011. From there they pivoted via SSH to Switzerland2 using an RSA key absent from authorized_keys, installed Ebury again, and reconfigured two hosted exit nodes. Control expanded to 333 exits whose operators' credential reuse or weak isolation allowed the same changes. No evidence shows how the remaining servers were reached.
Tor volunteer Kaba documented the campaign in a post that listed the exact port blocks and the 12 interceptor IPs. The SSH redirection triggered host-key warnings on affected circuits; users who accepted them supplied plaintext credentials. Email interception required services to downgrade to plaintext on allowed ports, an outcome not confirmed in logs released so far. The four-day window ended when operators noticed anomalous traffic volumes.
Ebury's reuse after twelve years highlights persistent failure to rotate management credentials across volunteer-run relays. The missing RSA key suggests either key theft from an unmonitored host or an undocumented trust relationship between the two servers. Prior incidents involving exit-node BGP hijacks and HSTS stripping showed similar traffic manipulation but lacked the scale of coordinated backdoor deployment across hundreds of nodes.
Operators must now enforce hardware-backed SSH keys and daily configuration diffs on all relays. The Tor Project is expected to publish a full incident report with affected fingerprints within 30 days.
Tor Project: 80 percent of current exit operators will publish mandatory SSH key fingerprints in relay descriptors within 90 days or be removed from the consensus.
Sources (3)
- [1]Tor Volunteers Incident Report(https://blog.torproject.org/333-exit-nodes-october-2026)
- [2]Ebury Backdoor Technical Analysis(https://www.welivesecurity.com/ebury-linux-backdoor-2014)
- [3]Ars Technica Coverage(https://arstechnica.com/information-technology/2026/10/300-tor-exit-nodes-hijacked-to-intercept-ssh-traffic-and-retrieve-plaintext-email/)