UNKNOWN attackers hijacked more than 300 Tor exit nodes to siphon unencrypted email and to redirect SSH connections through their own servers, a researcher reported on 2026-10-22. In the attack, 333 exit relays were compromised between 2 and 5 October, with the intruders gaining control via a valid password reused to access a Tor management server.
They then deployed the Ebury Linux backdoor on a second node (Switzerland2) and altered exit-node configurations to funnel SSH traffic to 12 interceptor servers, while also downgrading email participation by blocking common encrypted-mail ports (25, 465, 587, 993 and 995) but allowing unencrypted traffic.
The result could permit the attackers to capture SSH passwords and all subsequent typed commands; in one instance a participant observed an SSH warning about a changed host key, indicating a man-in-the-middle scenario.
Tor volunteers documented the episode through a mix of telemetry and honeypots. A test script polled the network’s roughly 3,000 exit nodes to identify which were contacting the attacker-controlled interception servers, and a honeypot captured the interception software attempting to log in and install Ebury. While some questions remain—such as how the attackers took control of so many servers and who exactly was behind the operation—the incident underscores the need for defence in depth.
The recommended responses include ensuring encryption-only for email, and disabling password authentication in favour of SSH keys to prevent similar intrusions in future.