Attackers ran Ebury on 333 Tor exits to steal SSH passwords
Original title: Hackers Hijack 333 Tor Exit Nodes to Intercept SSH Logins and Steal Credentials
About one in ten cited exit relays redirected port 22 to 12 interception servers from October 2 until BadExit flags and shutdowns on October 5.
Researcher kaba reported that attackers who had reached Linux servers in August installed Ebury 1.8.3 on 333 Tor exit nodes and, from October 2, redirected SSH on port 22 to password-stealing servers while passing encrypted web traffic. Users who ignored a changed host key and used passwords exposed credentials; attackers could then watch the session and try to install Ebury on the destination. Tor flagged relays BadExit on October 4, and the account says identified infected servers were shut down the next day.
Unconfirmed: Initial access is unknown; a hosting-provider breach is only a theory, and attribution is unresolved.
- The report cites about 3,000 Tor exit relays, with 333 affected.
- Allowed-port changes also steered exits toward unencrypted mail.
- A honeypot saw Paramiko and a Base64-encoded Perl installer after privilege checks.
- Operators applied the BadExit flag on October 4, which stops a relay from being an exit.
- Ebury is described as an OpenSSH backdoor and credential stealer, version 1.8.3.
Impact: Stolen SSH passwords and readable unencrypted mail
- 1.Investigate SSH host-key warnings instead of bypassing them.
- 2.Replace password logins with SSH keys.
- ATT&CK
- T1557 Adversary-in-the-MiddleT1021.004 Remote Services: SSHT1556 Modify Authentication Process
- Malware
- Ebury
- Organizations
- Tor Project
From the original article
3 min read at cybersecuritynews.com
Hackers compromised 333 Tor exit nodes and redirected SSH connections to password-stealing servers, according to a researcher’s account published October 20, 2026. The campaign began October 2 and targeted unencrypted email traffic alongside remote server logins. The affected nodes represented roughly one in ten of the approximately 3,000 Tor exit relays cited in the report.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.