333 Tor Exit Nodes Hijacked for SSH Interception Attack

A coordinated attack on October 2 compromised 333 Tor exit nodes—roughly 10% of the network’s ~3000 relays—to intercept SSH connections. The attackers, who gained access in August, deployed Ebury 1.8.3, a Linux backdoor and credential stealer. SSH traffic on port 22 was redirected to 12 interception servers where attackers captured credentials, observed commands, and attempted to infect targets with Ebury.

The author discovered the attack when their own SSH connection was intercepted Friday morning and reported it to Tor Project’s network health team. The response was rapid: by October 4, affected nodes were marked BadExit to prevent their use as exits; by October 5, all infected servers were offline. Initial access vectors remain unclear, though one theory suggests the hosting provider itself was compromised.

The incident underscores the importance of key-based SSH authentication over passwords for internet-facing systems.