NEW DELHI — More than 300 Tor exit nodes were compromised in an orchestrated cyberattack designed to intercept remote administrative traffic, harvest credentials, and capture unencrypted email messages, researchers have revealed. The attackers gained control of 333 exit relays between October 2 and October 5, altering network routing to channel Secure Shell (SSH) traffic through their own infrastructure and deploying a persistent Linux backdoor known as Ebury. The intrusion has renewed security concerns surrounding the open-source privacy network, though investigators are still working to determine how the perpetrators managed to breach such a wide swath of exit relays.
Reused Password Opened Path to Relays
The campaign trace back to late August, when an intruder accessed a primary Tor management server using a valid but reused administrative password. Once inside, the attacker installed Ebury, a malware variant first identified more than ten years ago that specializes in harvesting credentials on Linux systems.
From that initial foothold, the intruder moved laterally across the network to another server designated as Switzerland2. That connection was established using an RSA key that investigators could not locate among the authorized keys configured on the target machine. After securing root privileges on Switzerland2, the attackers installed Ebury there as well and altered the configuration files of two hosted exit nodes, laying the groundwork for the wider interception scheme. It remains unclear how control was subsequently extended across all 333 affected relays, though investigators suspect a commercial hosting provider servicing multiple nodes may have suffered a breach.
Rerouted Connections Exploited Host Key Warnings
With the nodes compromised, the attackers systematically redirected outbound SSH traffic to 12 dedicated interception servers under their control. While ordinary web browsing through the affected relays continued without interruption, users attempting remote server administration were steered into an active man-in-the-middle trap.
The attack relied heavily on users overlooking standard cryptographic alerts. When a connection was diverted, the client software flagged an unexpected change in the remote host key and displayed a security warning. A Tor volunteer identified as Kaba discovered the campaign after receiving one of these alerts during a routine connection attempt. Further examination revealed that whenever an administrator bypassed the warning, the attackers captured the entered password, forwarded the session to the intended destination, observed the commands issued by the user, and established a secondary connection to infect the remote target with Ebury.
Network Rules Altered to Force Plaintext Email
Alongside the SSH redirection, the attackers manipulated network settings on the hijacked nodes to disrupt encrypted email protocols. The altered relays systematically blocked connections to ports 465, 587, 993, and 995, which handle encrypted email submission and mailbox retrieval via IMAP and POP3, as well as port 25, the standard port for SMTP delivery.
By severing paths for encrypted transmission while permitting unencrypted traffic to pass, the attackers attempted to force client software into insecure downgrade fallbacks. Plaintext messages traversing the relays could then be logged and stored on the rogue servers. Investigators have not yet confirmed whether any mail clients actually reverted to unencrypted modes or whether readable email traffic was successfully stolen. The operation ceased after Kaba deployed detection scripts and a honeypot across approximately 3,000 exit nodes, isolating the 12 rogue destinations and mapping how the Ebury deployment routine functioned.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
