Roundup: Tor exit hijacks, Heartbreaker ransomware, and platform breaches
A researcher says 333 Tor exits, about a tenth of them, captured SSH passwords and tried to plant Ebury.
58
Organization
Tor Project
- Mentions · 7d0
- Mentions · 30d5
- All mentions9
- First seenSep 24, 2026
- Last mentioned19d ago
Timeline
9 articles · newest firstAttackers ran Ebury on 333 Tor exits to steal SSH passwords
About one in ten cited exit relays redirected port 22 to 12 interception servers from October 2 until BadExit flags and shutdowns on October 5.
74
Attackers hijacked 300-plus Tor exits to steal SSH passwords
Only password SSH logins over Tor from October 1 to 5 that accepted a fake host key could be captured.
72
Attackers compromise 333 Tor exits to steal SSH passwords and deploy Ebury
The relays were about 10% of Tor’s exit capacity; Tor flagged them BadExit by October 4 and infected servers were shut down October 5.
78
Ebury on 333 Tor exits stole mail and man-in-the-middled SSH
About 10% of Tor exits ran Ebury 1.8.3; relays were BadExit-flagged by October 4 and later shut down.
76
GoBalance Flaw Lets Attackers Hijack .onion Addresses by Recovering Tor-Format Keys
GoBalance signing flaw lets attackers recover Tor .onion master keys from public descriptors and hijack dark-web sites, as seen with Dread.
55
Self-Hosting on the Dark Web
A blogger mirrors a personal static site as a Tor hidden service with nginx and Hugo.
4
Fwd: Tor Project Forum: Security Release 0.4.9.13
Tor Project releases security update 0.4.9.13 with several high-severity fixes affecting relays, clients, and onion services; immediate upgrade urged.
55
Re: Fwd: Tor Project Forum: Security Release 0.4.9.12
Tor 0.4.9.12 patches a flaw that lets a malicious guard redirect circuit building to chosen relays undetected.
55
Appears with
- Torproduct · 6
- Eburymalware · 5
- OpenSSHproduct · 4
- Conclaveorganization · 1
- Bullhornvictim · 1
- Tor Projectvendor · 1
- Hookedgemalware · 1
- Searchlight Cyberorganization · 1
- ShinyHuntersthreat actor · 1
- nginxproduct · 1
- APT28threat actor · 1
- Symantecorganization · 1
- Heartbreakermalware · 1
- Dreadorganization · 1
- IECorganization · 1
- ISOorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.