Attackers compromise 333 Tor exits to steal SSH passwords and deploy Ebury
Original title: Hackers Compromise 333 Tor Exit Nodes to Steal SSH Credentials and Deploy Ebury Malware
The relays were about 10% of Tor’s exit capacity; Tor flagged them BadExit by October 4 and infected servers were shut down October 5.
A researcher reported that attackers compromised 333 Tor exit nodes, redirected SSH on port 22 to 12 interception servers, stole passwords from users who ignored host-key warnings, and tried to install Ebury 1.8.3. Underlying servers were accessed in August, with coordinated interception starting October 2. Encrypted web traffic continued normally. Tor’s network health team notified operators and restricted the relays; attackers later restarted many as middle relays.
Unconfirmed: Initial access and attribution are unresolved, and a compromised hosting provider was not confirmed.
- About a dozen relays showed fraudulent SSH fingerprints; over 300 only redirected traffic.
- The payload was identified as Ebury 1.8.3, an OpenSSH backdoor and credential stealer.
- Commands checked user ID and sudo, including passwordless elevation, before a Base64 payload.
- Attackers also changed torrc so some non-exit relays became exits.
- The researcher recommends SSH keys instead of password authentication.
Impact: SSH passwords stolen and Ebury backdoor installation attempted
| Product | Affected |
|---|---|
| Tor Project Tor exit relays | — |
- 1.Turn off SSH password authentication and use keys.
- 2.Treat Tor relays as highly targeted production systems.
- Malware
- Ebury
- Organizations
- Tor Project
From the original article
2 min read at gbhackers.com
Attackers compromised 333 Tor exit nodes in a coordinated campaign to intercept SSH connections, steal passwords, and deploy the Ebury Linux backdoor, according to a research account published on October 20, 2026. The compromised infrastructure accounted for approximately 10% of Tor’s roughly 3,000 exit relays. The researcher reported that attackers accessed the underlying servers in […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.