Attackers hijacked 333 Tor exit relays to steal SSH passwords
October 22: Ars Technica adds a reused management-server password, the Switzerland2 host, Ebury on two servers, and blocked mail ports 25, 465, 587, 993 and 995.
About 333 Tor exit relays that redirected SSH were BadExit-flagged on October 4, and infected servers were shut down by October 5.
Unknown attackers who had access since August installed Ebury 1.8.3 and, from October 2, redirected SSH on port 22 from 333 Tor exit relays to 12 interception servers. Password logins that accepted a changed host key could be stolen; encrypted web traffic continued, while some exits were pointed at unencrypted mail. Hacker News, GBHackers and Cyber Security News describe about 10 percent of 3,000 exits; The Hacker News says 7.46 percent of exit capacity on October 4. Tor marked the relays BadExit that day. Hacker News says infected servers were shut down October 5 and many restarted only as middle relays; The Hacker News says none remained in the consensus. Ars Technica, citing Tor volunteers, reports a reused password on a management server in late August; Hacker News says the first compromise method is unknown.
- Payload identified as Ebury 1.8.3, an OpenSSH backdoor and credential stealer.
- About a dozen relays showed fake SSH fingerprints; over 300 only redirected.
- The Hacker News cites 377 relays from 59 operators matching the attack policy.
- Attackers opened port 22 on 342 relays and turned 24 non-exits into exits.
- Ars Technica says exits blocked mail ports 25, 465, 587, 993 and 995.
- Key-based SSH could not be relayed; no victim count has been reported.
Timeline
dated events in the reporting · oldest first- Oct 2, 2026333 exits begin redirecting SSH to 12 servers · Hacker News
- Oct 4, 2026Tor marks the relays BadExit as capacity share peaks · The Hacker News
- Oct 5, 2026Infected servers shut down; some return as middles · Hacker News
What each outlet adds
beyond the shared facts- Hacker NewsExitmap results and relays later restarted only as middles.
- GBHackersSudo checks before a Base64 payload and torrc edits.
- The Hacker News7.46% capacity, 377 relays, and an interceptor fingerprint.
- Cyber Security NewsHoneypot observed Paramiko and a Base64 Perl installer.
- Ars TechnicaReused password, Switzerland2, and listed blocked mail ports.
- Malware
- Ebury
- Organizations
- Tor Project
Coverage
oldest first · one row per article · UTC- · 5d ago
Hacker News · securityFirst report
Ebury on 333 Tor exits stole mail and man-in-the-middled SSH
About 10% of Tor exits ran Ebury 1.8.3; relays were BadExit-flagged by October 4 and later shut down.
- · 4d ago
GBHackers
Attackers compromise 333 Tor exits to steal SSH passwords and deploy Ebury
The relays were about 10% of Tor’s exit capacity; Tor flagged them BadExit by October 4 and infected servers were shut down October 5.
- · 4d ago
The Hacker News
Attackers hijacked 300-plus Tor exits to steal SSH passwords
Only password SSH logins over Tor from October 1 to 5 that accepted a fake host key could be captured.
- · 4d ago
Cyber Security News
Attackers ran Ebury on 333 Tor exits to steal SSH passwords
About one in ten cited exit relays redirected port 22 to 12 interception servers from October 2 until BadExit flags and shutdowns on October 5.
- · 3d ago
Ars Technica · Security
333 Tor exit nodes hijacked to intercept SSH and email
Attackers reused a password, installed the Ebury backdoor, and sent port-22 SSH to 12 servers from October 2 to 5.