Science & Tech · Cybersecurity · 2 hrs ago
Attackers hijacked more than 300 Tor relays to intercept SSH logins
Attackers took control of more than 300 Tor exit relays in early October, changing how the relays handled network traffic.
Tor exit relays are the points where traffic leaves the Tor network for its destination.
The altered relays redirected SSH connections to 12 interception servers instead of the intended servers.
A password was at risk only if a user accepted the interception server’s key and entered a password between October 1 and 5.
Key-based SSH logins were not vulnerable to this interception, and users who knew a server’s real key would have seen a warning if it changed.
The Tor Project removed the affected relays by October 5, though directory data included other relays with matching policy changes that were not confirmed as compromised.
Some affected servers were found to have Ebury malware, and experts advised relay operators to check their systems, reinstall compromised hosts and change credentials.
Attackers hijacked more than 300 Tor exit relays in early October to redirect SSH connections and steal passwords.
The attackers changed relay settings to allow SSH traffic and routed connections through 12 interception servers.
A password could be captured if a user accepted an interception server’s host key and logged in.
The Tor Project flagged the activity and removed the affected relays from the network by October 5.
Researchers found that some compromised servers were infected with Ebury, a backdoor and credential-stealing malware.
- Who
- Attackers hijacked Tor exit relays; the Tor Project identified and removed the affected relays.
- What
- The attackers redirected SSH connections through interception servers to capture passwords from users who accepted fake host keys.
- When
- Early October 2026; the activity was reported on October 21.
- Where
- On the Tor network and its exit relays.
- Why
- Not stated
This story does not have two clearly opposing sides.
Directory data showed relays switching to the attackers’ exit policy.
Researcher kaba scanned about 3,000 Tor exits and found 333 redirecting SSH traffic to the same 12 interception servers.
The Tor Project began flagging relays, and the attack-policy relays reached 7.46% of Tor’s exit capacity.
No affected relays remained in Tor’s consensus.
- Relays found redirecting SSH
- 333
- Interception servers
- 12
- Relays matching the attackers’ exit policy
- 377 relays run by 59 operators
- Peak share of Tor exit capacity
- 7.46% on October 4
- Port affected
- Port 22, used for SSH
3 sources
What people are saying
It seems the attacker is gaining access to Linux based hosts and when these machines are running non-exits they are editing the torrc file and turning them into exits to be able to carry out the SSH attack
a policy match, not proof of compromise