GoKawiilResearchers find 333 Tor exit nodes hijacked to intercept SSH and email traffic
A security researcher reported that attackers compromised a Tor management server in late August using a reused password, then installed the Ebury Linux backdoor and gained control of a second server called Switzerland2. From there they reconfigured 333 exit relays between October 2 and 5 to redirect SSH traffic to attacker-controlled servers and block ports used for encrypted email while leaving unencrypted email ports open.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident shows how a single reused password and a well-known old backdoor could cascade into control over hundreds of nodes in a network many rely on for anonymity, suggesting gaps in operational security among relay operators. It remains unclear whether the attackers actually captured usable plaintext credentials or messages, so the practical damage from the campaign is still uncertain.
- 333 Tor exit relays were reconfigured to intercept SSH and email traffic between October 2 and 5.
- Attackers used a reused password and the Ebury backdoor to gain control of a Tor management server and a second server, Switzerland2.
- Investigators have not determined how attackers gained control of all 333 exit relays, nor whether any interception attempts actually succeeded.
YubiKey 5 NFC security key — This incident stemmed from a reused password granting access to critical infrastructure—exactly the kind of credential compromise hardware security keys are designed to prevent. A YubiKey adds phishing-resistant two-factor authentication to SSH and server logins, making stolen or reused passwords alone useless to attackers. It's a practical step for anyone managing servers or sensitive accounts who wants to avoid becoming the next Ebury victim.
See YubiKey 5 NFC security key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: arstechnica.com, 2026-10-22
Published there as: “333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.