On Friday, October 2, 2026, at 9:35am, 333 infected exit nodes began a coordinated campaign to intercept SSH connections and collect as much unencrypted data as possible. With Tor operating roughly 3000 exit relays, about 10% were under the attackers' control. The attackers had gained access to the servers in August and quietly deployed the Ebury 1.8.3 payload, an OpenSSH backdoor and credential stealer for Linux.
The attack had two main goals: gathering as much unencrypted mail traffic as possible, and intercepting SSH connections in a man-in-the-middle attack. By blocking certain ports, the compromised exit nodes handled only unencrypted mail. Traffic on Port 22 was redirected to one of 12 SSH interception servers. Users who ignored the host key warning had their passwords stolen, their commands observed, and their servers infected with Ebury.
The author reported the findings to the Tor Project's network health team on Friday evening. The team confirmed the attack was new and contacted the affected relay operators. By Sunday, October 4, operators began shutting down their exit nodes, and the relays were flagged as Bad Exit so clients would stop using them to exit traffic. The attackers restarted some relays on Monday, but because they were already flagged, those could only serve as middle relays. All infected servers were eventually shut down, and a clear dip in network metrics appeared on October 4.
The team said the attacker gained access to Linux hosts and edited the torrc files of non-exit relays to turn them into exits for the SSH attack. The author found the infected nodes by testing each of the roughly 3000 exit relays with exitmap, checking whether SSH fingerprints matched across pinned connections.
Source: Hacker News · Summarized by HeadlinesBriefing