Over 300 Tor exit nodes hijacked in SSH and email interception campaign

The attack began when the hackers used a valid password that had been reused to gain access to a Tor management server, Tor volunteers reported. From there, the attackers installed Ebury, a Linux backdoor first discovered 12 years ago. They then connected from the management server to a second Tor server, dubbed Switzerland2, via SSH using an RSA key that investigators could not find among that server's authorized keys. With administrative control of Switzerland2, the attackers installed Ebury there as well and reconfigured settings on two exit nodes hosted on the server.

The hijacked nodes were modified to favor unencrypted email traffic and to route SSH connections through systems under the attackers' control. Researcher noted that several mysteries remain about the operation, including how the RSA key was authorized for SSH access.

Analysis

Why This Matters

Tor exit nodes are the last hop in the anonymizing network, making their compromise a severe threat to user privacy.
Intercepted unencrypted email and redirected SSH traffic could expose credentials, communications, and sensitive data.
The use of a reused password highlights ongoing security weaknesses in infrastructure management.

Background

Tor exit nodes are operated by volunteers and are the point where traffic exits the Tor network to reach the open internet. Compromised exit nodes can monitor or modify traffic. The Ebury backdoor is a known Linux malware that has been deployed in various campaigns since its discovery in 2014. The attack shows that even curated volunteer infrastructure remains vulnerable.

Key Perspectives

Tor Project volunteers: Concerned about the breach and working to identify and remove compromised nodes. The attack exploited poor credential hygiene on a management server. Security researchers: Point to the difficulty of auditing distributed volunteer-run networks and the need for stronger authentication and monitoring. Users: Those relying on Tor for anonymity or security may face exposure if they used unencrypted email or SSH without additional verification.

What to Watch

Whether additional compromised nodes are discovered beyond the initial 333.
Any updates from Tor Project on mitigation measures or changes to server management practices.
Possible disclosure of intercepted data or further attribution of the attackers.

Checked

9 claims in this story checked against 1 source: 7 supported.

Show each claim

SupportedMore than 300 Tor exit nodes were hijacked and reconfigured to favor unencrypted email traffic and redirect SSH connections through attacker-controlled servers.Ars Technica - All content: “Unknown hackers hijacked more than 300 Tor exit nodes and reconfigured them to favor unencrypted email traffic and redirect SSH connections through servers they controlled”
SupportedThe attack involved intercepting SSH traffic and retrieving plaintext email.Ars Technica - All content: “333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email.”
Partly supportedThe report was published Tuesday.Ars Technica - All content: “a researcher reported Tuesday.”
SupportedThe hijacking began in late August.Ars Technica - All content: “The hijacking began in late August,”
SupportedTor volunteers said the attacker used a valid, reused password to access a Tor management server.Ars Technica - All content: “when according to Tor volunteers , the attacker used a valid password that had been reused to gain access to a Tor management server.”
SupportedThe attackers installed Ebury, a Linux backdoor discovered 12 years ago, on the management server and then on Switzerland2.Ars Technica - All content: “The attacker then installed Ebury , a backdoor written for Linux that was discovered 12 years ago. ... With administrative control of Switzerland2, the attackers installed Ebury there as well.”
SupportedThe attackers connected from the management server to Switzerland2 over SSH using an RSA key investigators could not find among its authorized keys.Ars Technica - All content: “Then the attacker connected from the management server to a second Tor server, called Switzerland2, through SSH, using an RSA key that, for unknown reasons, investigators couldn’t find among Switzerland2’s authorized keys.”
SupportedThe attackers had administrative control of Switzerland2 and reconfigured settings on two exit nodes hosted there.Ars Technica - All content: “With administrative control of Switzerland2, the attackers installed Ebury there as well. Finally, the attacker reconfigured settings on two exit nodes that Switzerland2 hosted.”
Partly supportedA remaining mystery is how the RSA key was authorized for SSH access.Ars Technica - All content: “using an RSA key that, for unknown reasons, investigators couldn’t find among Switzerland2’s authorized keys.”