Attackers hijack 333 Tor exit nodes with legacy Ebury malware to intercept SSH and strip email encryption

The Tor Project's volunteer security and network directory authority teams published a joint forensic report on Thursday detailing the compromise of 333 Tor exit nodes in an active eavesdropping and credential theft campaign.[4]

According to investigators, the intrusion commenced in late August when threat actors leveraged a compromised administrative password that had been recycled across external systems to gain root access to an internal Tor management server. The attackers deployed Ebury, a notorious 12-year-old Linux kernel backdoor, and subsequently jumped through administrative SSH tunnels to compromise a core infrastructure host designated Switzerland2, altering configuration templates across hundreds of dependent exit nodes.[4]

The attackers modified the compromised exit nodes to execute two distinct surveillance operations: redirecting all outbound SSH traffic across Tor to one of 12 attacker-controlled servers to harvest user passwords when host-key mismatch warnings were ignored, and blocking encrypted mail ports (25, 465, 587, 993, and 995) to force legacy mail transfer agents into unencrypted plaintext transmissions. Tor directory authorities isolated and purged the rogue relays between October 2 and October 5.[4]

Our take: The compromise of hundreds of Tor exit nodes highlights a critical blind spot in privacy network security: an anonymizing relay network is only as robust as the system administration hygiene of its individual node operators. Tor's multi-hop onion routing successfully protected users' physical IP addresses, but unencrypted payloads and carelessly bypassed SSH fingerprint warnings remain fully vulnerable at the exit perimeter. True privacy demands end-to-end cryptographic verification, not blind trust in network relays.

Sources

1. [4] Tor Security Advisory on 333 Hijacked Exit Relays and Ebury Backdoor