Hackers Hijack 333 Tor Exit Nodes to Intercept SSH and Email Traffic
Researchers identified a campaign where attackers compromised 333 Tor exit nodes to intercept SSH connections and plaintext email. The breach began in late August when a reused password on a management server allowed access. Attackers installed the Ebury backdoor, redirecting SSH traffic to 12 interceptor servers and blocking encrypted email ports. This significant security lapse exposes Tor users to credential theft, though the full scope of server control remains under investigation.
Key points
- Researchers reported that unknown hackers hijacked 333 Tor exit nodes to intercept SSH traffic and unencrypted email, a campaign that began in late August.
- The initial breach occurred when an attacker used a reused valid password to access a Tor management server, subsequently installing the Ebury Linux backdoor.
- Attackers gained administrative control of a server named Switzerland2 via an unexplained RSA key, then reconfigured two of its hosted exit nodes.
- The reconfiguration redirected SSH traffic to 12 attacker-controlled interceptor servers, capturing passwords from users who ignored host key change warnings.
- Email interception was achieved by blocking ports 25, 465, 587, 993, and 995, forcing traffic through unencrypted channels while encrypted mail was blocked.
- Investigators have not yet determined how the attackers gained control of all 333 underlying servers, leaving the full extent of the compromise partially unresolved.
Security researchers have uncovered a sophisticated attack on the Tor network, where more than 300 exit nodes were compromised to intercept sensitive user traffic. The campaign, which began in late August, targeted both Secure Shell (SSH) connections and email communications, exposing users to potential credential theft and data leakage. The breach highlights persistent vulnerabilities in the infrastructure that underpins anonymous browsing.
The attack sequence started when an unknown actor accessed a Tor management server using a reused password. Once inside, the attacker installed Ebury, a Linux backdoor first identified 12 years ago. From this foothold, the attacker connected to a second server, designated Switzerland2, using an RSA key that investigators could not immediately locate among authorized keys. With administrative control of Switzerland2, the attackers deployed the backdoor there as well and reconfigured settings on two of its hosted exit nodes.
Ultimately, 333 exit relays were involved in the interception campaign. The attackers implemented two primary modifications: redirecting SSH traffic to 12 interceptor servers they controlled, and blocking specific ports (25, 465, 587, 993, and 995) used for encrypted email. This forced email traffic through unencrypted channels while SSH users who ignored host key warnings entered their passwords into the interceptor servers. While the mechanism is clear, the method by which the attackers secured control of all 333 servers remains under investigation, raising questions about the depth of the network's exposure.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.
