Attackers compromised 333 Tor exit nodes to intercept SSH and e-mail traffic

Attackers compromised 333 Tor exit nodes between Oct. 2 and Oct. 5, 2026, intercepting SSH traffic and capturing plaintext e-mail by blocking encrypted mail ports and forcing unencrypted connections through modified relays.

The campaign started when intruders used a reused password to enter a Tor management server and install Ebury 1.8.3, a Linux backdoor first identified in 2009. Ebury replaces legitimate SSH daemons with trojanized versions, enabling long-term remote access. From that server, the operator used SSH with an unknown RSA key to compromise a second machine, Switzerland2, and reconfigure exit nodes.

The attackers then modified torrc configuration files, the settings that control how a Tor relay operates, to convert 24 previously non-exit relays into exits. The modified nodes blocked encrypted e-mail ports 25, 465, 587, 993 and 995 while allowing unencrypted POP3 and IMAP traffic, forcing mail services to downgrade connections and expose messages in plaintext. This change let attackers redirect SSH traffic from nodes that had not previously served as exits.

Attackers routed SSH connections through 12 interception servers using Paramiko, a Python library for SSH automation, which let attackers extract credentials while maintaining session integrity. The intrusion did not break SSH encryption; it depended on users ignoring SSH host-key verification warnings, which alert people when a server’s identity has changed and may indicate a man-in-the-middle attack. Those who ignored the alerts exposed their passwords and allowed command monitoring throughout the session. The machines used ED25519 keys (a public-key signature algorithm used for SSH authentication), one bearing the fingerprint SHA256:6baCZCPsl+AfQuujUS81fMEE/C7UeJ+AwjrImqmDB3E, which Kaba observed during an SSH connection test.

Kaba found the intrusion on Oct. 2, 2026, after an SSH host-key mismatch warning appeared, and then used exitmap to scan Tor exits for compromised nodes. The network health team at Tor confirmed the intrusion on Oct. 4 and worked with relay operators, including one known as Quetzalcoatl, to shut down affected relays and rotate credentials. Operators flagged all 333 nodes with BadExit, a mark that prevents Tor clients from using a relay as an exit, and Tor’s directory authorities removed the affected relays from the network. By Oct. 5 operators had shut down the affected relays, and no new infections appeared by Oct. 9.

The attack exploited Tor’s trust model, where exit nodes are assumed to act as neutral intermediaries without verification. The 333 compromised relays represented about 10% of Tor’s roughly 3,000 exit relays, or roughly 7.46% of the network’s exit capacity by consensus weight. Because exit nodes handle traffic as it leaves the network and enters the public internet, unencrypted messages passing through them are exposed to interception if the node is malicious.

Ebury infections have affected more than 400,000 Linux servers since 2009, and version 1.8.3 was active as early as June 2026. Ebury logins leave no records, and ESET’s detection tools did not flag version 1.8.3 until October 2026. Hosting environments continue to face a persistent threat from the backdoor.

How most compromised servers were first accessed is still unknown, although a hosting-provider breach is suspected. SSH, sudo and encrypted backups all used a single password, stored in plaintext.

The project tells users to steer clear of sensitive unencrypted traffic over the network, check SSH host fingerprints through an out-of-band method, and regard all exit-node traffic as observable. Anyone who accepted an unfamiliar SSH host key from Oct. 1 through Oct. 5 should treat passwords as exposed and look for Ebury infections. OpenSSH programs store accepted keys in known_hosts files, so unfamiliar entries need manual verification.

The project recommends replacing password logins with SSH keys, which remain resistant to interception. Users should verify SSH host fingerprints through an independent channel rather than accepting a key presented during a connection.

Relay operators should audit torrc files for unauthorized changes to ExitRelay, ExitPolicy and ContactInfo settings, verify SSH configurations, rotate credentials and rebuild any compromised systems from scratch. The attack highlighted a lack of automated intrusion detection systems and real-time monitoring on Tor exit nodes, gaps that current Tor tooling has not fully addressed.