A campaign compromised 333 Tor exit nodes—about 10% of the network’s exits—with Ebury 1.8.3, a Linux OpenSSH backdoor and credential stealer. Researcher KABA says the attackers had accessed the servers in August and kept the malware hidden for two months before launching the operation on 2 October. The infected relays blocked certain ports, limiting the traffic they carried to unencrypted mail, and hijacked SSH connections on port 22, redirecting users to one of 12 interception servers.
KABA detected the activity by testing roughly 3,000 Tor exits with exitmap, using SSH connections between two of his own servers. About a dozen exits presented a fake SSH key, while more than 300 routed traffic through the interception servers. KABA’s SSH client warned that the remote host identification had changed; users who proceeded could have their passwords stolen and commands monitored. The article also says a second connection could infect a victim’s server with Ebury. It does not report confirmed infections among users.
KABA reported the findings on 2 October. The Tor network health team warned relay operators on 4 October and marked the affected nodes as BadExit, preventing clients from using them as exits; all infected servers were offline by 5 October. The initial route into the servers and the attackers’ identity remain unknown. The article recommends disabling SSH password logins and using keys, while noting a researcher’s warning that other compromised Tor relays may remain.