More than 300 Tor exit nodes were hijacked in a campaign that targeted SSH credentials and plaintext email. From October 2 to October 5, 2026, the attacker redirected traffic through 12 interceptor servers, creating a trap for Tor users who trusted familiar connections.
The campaign involved 333 Tor exit relays, but the intrusion began earlier, in late August. A valid password that had been reused gave the attacker access to a Tor management server, where the attacker installed Ebury, a backdoor written for Linux.
A Stolen Password Opened the Door
From that management server, the attacker connected through SSH to a second Tor server called Switzerland2. The connection used an RSA key that investigators could not find among Switzerland2’s authorized keys, yet Switzerland2 accepted the key even though there was no evidence it was an authorized SSH certificate.
The attacker then reconfigured settings on two exit nodes hosted by Switzerland2. That change became the starting point for a campaign that reached hundreds of relays and altered how SSH and email traffic moved through Tor.
Tor volunteers do not know how the attacker accessed so many servers. One possibility is that a company hosting the servers was hacked, but the facts do not establish how the broader access happened.
SSH Warnings Became the First Line of Defense
The attacker redirected SSH traffic traveling through Tor to one of 12 attacker-controlled interceptor servers. That redirection created an opportunity to capture login attempts from users whose connections passed through the compromised exit nodes.
Tor users who ignored warnings that an SSH host key had changed would then enter their SSH passwords. The warning was not subtle. It told users that someone could be eavesdropping on the connection and identified a possible man-in-the-middle attack.
Kaba, the Tor volunteer who authored the post, recorded the warning this way:
“@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The fingerprint for the ED25519 key sent by the remote host is SHA256:6baCZCPsl+AfQuujUS81fMEE/C7UeJ+AwjrImqmDB3E. Please contact your system administrator.”
That message mattered because accepting the changed key could expose an SSH password to the interceptor. The incident turned a familiar security warning into a dividing line: users who stopped to investigate had a chance to avoid the trap, while users who ignored it could hand over their credentials.
Email Rules Revealed the Campaign’s Goal
The exit nodes were also reconfigured to block ports 25, 465, 587, 993, and 995, which are used for encrypted email. At the same time, the nodes allowed ports for unencrypted email, steering traffic toward channels that could be read in plaintext.
That combination gave the attacker two paths to valuable data. SSH interception targeted passwords, while the email settings exposed messages that traveled without encryption. The campaign did not simply disrupt Tor traffic; it changed which kinds of communication could pass through the exit nodes.
Kaba created a script that polled all of Tor’s roughly 3,000 exit nodes and checked them for correct SSH fingerprints from a test server. That process helped identify the scope of the damage among the network’s thousands of exit nodes.
Kaba also set up a honeypot to observe the interception software attempting to log in and install Ebury. The honeypot provided a controlled view of the tools involved, connecting the traffic manipulation with the Linux backdoor found during the investigation.
Questions Remain Across the Tor Network
The use of Ebury and the broad collection of unencrypted data suggest a financially motivated crime group, though that remains speculation. The confirmed facts show access through a reused password, an unexplained RSA key accepted by Switzerland2, altered exit-node settings, and a campaign that ultimately involved 333 relays.
The incident also shows why SSH host-key warnings demand attention. A changed fingerprint can signal a routine key replacement, but it can also expose an active interception attempt. In this case, ignoring that warning could lead users to enter passwords into a connection controlled by the attacker.
Tor volunteers now face a larger unanswered question: how did one attacker move from a management server to hundreds of exit nodes? Until that path becomes clear, the campaign leaves both a technical trail and a warning for every operator managing SSH access across a large network.
Based on
