Tech

333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email

Read full article at source ↗

Based on a feed excerpt; full article content has not been acquired. Source evidence retrieved 22/10/2026, 13:58:23 UTC.

Briefings

Hackers controlled over 300 Tor exit nodes in late August 2026 by exploiting a reused password to access a Tor management server and installing the Ebury backdoor. They then connected to Switzerland2 via SSH using an unlisted RSA key, installed Ebury there, and reconfigured two exit nodes to prioritize unencrypted email traffic while redirecting SSH connections to their own servers. The attack began in late August and involved a Linux-based backdoor discovered 12 years prior.

Key points

• Hackers exploited a reused password to gain administrative access to a Tor management server in late August 2026.
• The attacker installed the Ebury backdoor on the Tor management server and subsequently on Switzerland2 via SSH.

Context

This incident represents a significant expansion of Tor's infrastructure compromise, as researchers report over 300 exit nodes were hijacked. The use of a reused password and the specific backdoor suggest a sophisticated, long-term attack campaign rather than a single event.

Limitations

The evidence is limited to a researcher's report from October 2026. Specific details about the attacker's identity, the exact date of the initial password compromise, and the precise timeline of the backdoor installation remain unknown.

Generated by Bittrees-hosted qwen35-2b sha256:aaf42c8b7c3c on 22/10/2026, 14:00:11 UTC. Based on publisher-provided feed evidence; may not cover the full original article. Check the source for details.

View archived briefing on IPFS
bafybeieqz5izwdeyioyq5qcwzpgf3m6pawbdwhem6nzq4m6jqnhcnhbxiq