GoKawiilResearchers find 333 Tor exit nodes hijacked to intercept SSH and email traffic
A security researcher reported that attackers compromised a Tor management server in late August using a reused password, then installed the Ebury Linux backdoor and gained control of a second server called Switzerland2. From there they reconfigured 333 exit relays between October 2 and 5 to redirect SSH traffic to attacker-controlled servers and block ports used for encrypted email while leaving unencrypted email ports open.