On October 2, a coordinated attack leveraged 333 compromised Tor exit nodes—approximately 10% of the network’s roughly 3,000 total relays—to intercept unencrypted traffic and conduct man-in-the-middle attacks on SSH connections.
According to the source, attackers had gained access to the servers two months earlier in August and deployed the Ebury 1.8.3 payload, an OpenSSH backdoor and credential stealer for Linux. The attack pursued two primary objectives: gathering unencrypted mail traffic by blocking certain ports on the compromised nodes, and intercepting SSH connections on port 22.
When a user’s Tor circuit exited through one of the infected nodes and attempted an SSH connection, they were silently redirected to one of 12 SSH interception servers. The attacker would then steal the user’s password, open a connection to observe commands being typed, and attempt to infect the target server with the Ebury malware.
The researcher who discovered the attack contacted the Tor Project’s network health team on Friday evening. The response timeline showed rapid coordination: by Sunday, October 4, the health team announced the compromise to relay operators, who began shutting down their nodes. The same day, the infected relays were marked with a “BadExit” flag preventing clients from using them to exit traffic. On October 5, when attackers attempted to restart many relays, they were blocked from functioning as exit nodes due to the flag. All infected servers were subsequently shut down.
To identify the compromised nodes, the researcher used exitmap to systematically test each of Tor’s approximately 3,000 exit relays by pinning specific nodes and monitoring whether SSH connections received correct fingerprints or were redirected to interception servers. This revealed roughly a dozen nodes serving fake fingerprints and over 300 performing redirects through the same interception infrastructure.
The source notes significant open questions remain unanswered. The method by which attackers gained initial access to so many servers is unclear, though one theory suggests the hosting company itself was compromised. The attackers’ identity is also unknown, though the use of Ebury and broad data collection suggest financial motivation. According to cited analysis, Ebury infected approximately 400,000 servers between 2009 and 2023, suggesting other compromised Tor relays may exist. Metrics from the Tor Project showed a clear network capacity reduction on October 4 that had not recovered by the time of writing.
Key facts
- 333 infected Tor exit nodes conducted a coordinated attack on October 2, representing roughly 10% of the network’s exit capacity
- Attackers gained access to servers in August and deployed Ebury 1.8.3, an OpenSSH backdoor and credential stealer
- SSH connections were redirected to 12 interception servers where passwords were stolen, commands monitored, and malware deployed
- The Tor Project’s network health team marked all 333 nodes as BadExit by October 4, preventing their use for traffic exit
- All compromised servers were shut down by October 5, creating a visible capacity dip in the Tor network