Roundup: Tor exit hijacks, Heartbreaker ransomware, and platform breaches
A researcher says 333 Tor exits, about a tenth of them, captured SSH passwords and tried to plant Ebury.
58
- Mentions · 7d7
- Mentions · 30d7
- All mentions7
- First seenOct 20, 2026
- Last mentioned2d ago
Timeline
7 articles · newest first333 Tor exit nodes hijacked to intercept SSH and email
Attackers reused a password, installed the Ebury backdoor, and sent port-22 SSH to 12 servers from October 2 to 5.
78
Attackers ran Ebury on 333 Tor exits to steal SSH passwords
About one in ten cited exit relays redirected port 22 to 12 interception servers from October 2 until BadExit flags and shutdowns on October 5.
74
Attackers hijacked 300-plus Tor exits to steal SSH passwords
Only password SSH logins over Tor from October 1 to 5 that accepted a fake host key could be captured.
72
Attackers compromise 333 Tor exits to steal SSH passwords and deploy Ebury
The relays were about 10% of Tor’s exit capacity; Tor flagged them BadExit by October 4 and infected servers were shut down October 5.
78
Attacker hijacks over 10% of Tor exit relays with Ebury
More than 330 relays were infected from October 2 to 5 to sniff SSH and downgrade email before Tor blocklisted them.
76
Ebury on 333 Tor exits stole mail and man-in-the-middled SSH
About 10% of Tor exits ran Ebury 1.8.3; relays were BadExit-flagged by October 4 and later shut down.
76
Appears with
- Torproduct · 6
- Tor Projectorganization · 5
- OpenSSHproduct · 4
- Hookedgemalware · 1
- Tor security teamorganization · 1
- ShinyHuntersthreat actor · 1
- APT28threat actor · 1
- Symantecorganization · 1
- Heartbreakermalware · 1
- IECorganization · 1
- ISOorganization · 1
- Railwayvictim · 1
- NSO Groupthreat actor · 1
- Conduentvictim · 1
- Bullhornvictim · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.