333 Tor exit nodes hijacked to steal SSH logins and email

Unknown attackers quietly turned hundreds of Tor's exit relays into a trap for SSH users and email traffic, according to a report from a Tor volunteer covered by Ars Technica. For three days, from 2 to 5 October, 333 exit relays were reconfigured to intercept traffic before it left the anonymity network.

How the attackers got in

Tor volunteers say the campaign started in late August, when someone logged in to a Tor management server with a valid but reused password and installed Ebury, a Linux backdoor first documented about 12 years ago. From there the attacker reached a second server, called Switzerland2, over SSH using an RSA key investigators couldn't find among that server's authorised keys, installed Ebury again and changed the settings of exit relays it hosted.

How the attacker gained control of all 333 relays is still unknown. One theory is that a hosting company was compromised, but Ars says that remains unproven.

What the hijacked relays did

Tor encrypts traffic inside the network, but an exit relay hands it to the open internet, so anything not encrypted end to end is visible there. The attackers exploited that in two ways:

• SSH redirection. Connections to port 22 were silently routed to one of 12 interception servers. Users saw SSH's "remote host identification has changed" warning. Anyone who clicked through it could give away their password; the volunteer found the attacker then watched typed commands and installed Ebury on the target server.
• Email downgrades. The relays blocked ports 25, 465, 587, 993 and 995, which handle encrypted email connections, while allowing ports for plaintext mail. If an email client or service fell back to an unencrypted connection, the attacker could read the messages. It isn't known whether any downgrade succeeded.

Ordinary HTTPS browsing was forwarded normally, which is why the campaign was easy to miss.

How it was found

The volunteer, who goes by Kaba, was redirected personally while connecting over SSH. Kaba then wrote a script that checked roughly 3,000 Tor exit nodes against a test server with a known SSH fingerprint, and set up a honeypot to watch the interception software try to log in and install its backdoor. Kaba suggests the broad grab of unencrypted data points to a financially motivated group, while stressing that this is speculation.

What you should do

You don't need to stop using Tor, but this is a reminder that an exit relay is an untrusted network, much like public Wi‑Fi:

• Never accept an unexpected SSH host-key change. Verify the fingerprint through another channel first.
• Use SSH keys and disable password logins on your servers, so a stolen password alone isn't enough.
• Force encrypted email: configure clients to require TLS and refuse plaintext fallback.
• Patch and audit servers. Recent bugs like the PHP2Shell flaws show how quickly exposed systems get targeted.

For a broader look at how metadata can leak even when content is protected, see our explainer on Meta's share links and passive DNS exposure.