ATTACKERS hijacked more than 300 Tor exit relays in early October and used them to intercept SSH connections passing through Tor, diverting them to servers that collected login passwords. The attacker-controlled exits rewrote each relay’s torrc to enable port 22, turning otherwise non‑SSH exits into targets and, in many cases, closing encrypted mail ports while opening plaintext options.
Affected connections would present the interceptor’s host key, causing warning prompts for users who had not expected a key change, and password entry would then be captured by the interceptor. The operation was discovered when a researcher known as kaba detected 333 SSH redirects from Tor’s exits to just 12 interception hosts, and the Tor Project’s health team began flagging suspicious relays on 4 October with the consensus ultimately purged of the attacker’s policy by 5 October.
Evidence links the intrusion to a long‑running backdoor operation tied to the OpenSSH–Ebury family. Two of Zimmer’s FranTech/BuyVM hosting relays reportedly ran Ebury version 1.8.3, and the attackers gained initial access via exposed management servers, embedding the backdoor on relays and altering their torrc to act as exits.
The backdoor logs leave little trace, making attribution difficult; however, the campaign’s signs included a unique set of host keys, altered ExitPolicy lines, and the presence of a malicious library tied to Ebury. Tor operators and directory authorities coordinated a rapid response: relays were taken offline, disk images preserved, keys rotated, a new relay identity issued, and compromised credentials replaced.
By 17:00 UTC on 5 October no relay with the attacker’s policy remained in the consensus, though some residual policy indicators persisted briefly. Operators are advised to inspect Exit flags, torrc changes, NAT rules on port 22, unknown processes, new users, and unauthorized keys, and to reinstall relays if compromise is suspected.