GoKawiilResearcher helps Tor Project remove over 300 compromised exit nodes tied to Ebury malware
A security researcher discovered that 333 Tor exit relays—about 10% of the network—had been infected since August with the Ebury SSH backdoor and were coordinating a man-in-the-middle attack on SSH connections starting October 2. The compromised nodes redirected SSH traffic to 12 interception servers that stole passwords and harvested unencrypted mail traffic, prompting the researcher's report that led to the removal of the infected exit nodes from the Tor network.