GoKawiilResearcher helps Tor Project remove over 300 compromised exit nodes tied to Ebury malware
A security researcher discovered that 333 Tor exit relays—about 10% of the network—had been infected since August with the Ebury SSH backdoor and were coordinating a man-in-the-middle attack on SSH connections starting October 2. The compromised nodes redirected SSH traffic to 12 interception servers that stole passwords and harvested unencrypted mail traffic, prompting the researcher's report that led to the removal of the infected exit nodes from the Tor network.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident shows that a relatively small set of compromised relays can threaten a meaningful share of Tor's exit capacity, raising questions about how operators vet and monitor the servers that handle exit traffic. It also underscores that Tor only encrypts traffic within its network—unencrypted protocols like SSH and mail remain vulnerable to interception at the exit point, which could inform how users configure endpoint security when relying on Tor.
- 333 of roughly 3,000 Tor exit relays (about 10%) were infected with the Ebury SSH backdoor since August.
- The compromised nodes redirected SSH connections to 12 interception servers to steal passwords and unencrypted mail data.
- A researcher's investigation led directly to the removal of the infected exit nodes from the Tor network.
Source: kaba.cx, 2026-10-20
Published there as: “How I got over 300 Tor exit nodes removed”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.