TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A Tor relay operator reports that 333 compromised exit nodes were used in an SSH interception campaign beginning Oct. 2, 2026. The operator’s testing and Tor Project response led to the relays being marked unusable for exit traffic and the infected servers being shut down by Oct. 5, though how they were compromised and who was responsible remain unknown.
A Tor operator says a coordinated campaign used 333 compromised exit relays to redirect SSH connections through interception servers, prompting the Tor Project and relay operators to disable the affected nodes in early October. The operator’s Oct. 20 account says the relays represented roughly 10% of Tor’s approximately 3,000 exit relays at the time, though the precise impact and the original route into the servers remain unclear.
The operator’s account says the activity began at 9:35 a.m. on Oct. 2, after attackers had allegedly accessed the affected Linux servers in August and installed Ebury 1.8.3, described in the report as an OpenSSH backdoor and credential-stealing malware. The account says the campaign sought unencrypted mail traffic as well as SSH credentials and access. The writer focuses on SSH interception, rather than the mail-collection activity.
According to the report, users whose Tor circuits exited through an affected relay could have ordinary encrypted web traffic forwarded normally, while SSH connections on port 22 were redirected to one of 12 interception servers. The operator says an unexpected SSH host-key warning alerted them to the incident. Their subsequent tests reportedly found that around a dozen relays presented a false SSH fingerprint, while more than 300 others redirected connections through the same interception infrastructure.
The operator contacted the Tor Project’s network health team on Friday evening. The account says the team alerted relay operators on Oct. 4 and the affected relays were marked BadExit, preventing Tor clients from using them for exit traffic. Some relays were restarted the following day, but the report says they could serve only as middle relays after being flagged. By Oct. 5, the infected servers had been shut down, in some cases by their operators and in others by the attackers.
How the Relays Threatened SSH Users
The incident shows how a compromised Tor exit relay can create risks that differ from the privacy protections Tor is designed to provide. Tor routes traffic through multiple relays, but an exit relay handles a connection as it leaves the network. End-to-end encryption remains important: unencrypted traffic can be exposed at that point, and the operator says SSH connections were actively redirected to interception servers.
According to the account, proceeding past the unexpected SSH host-key warning could expose a password and allow an attacker to observe commands entered in the session. The report also says the attackers attempted to use intercepted access to install Ebury on destination servers. These are claims about the operation described by the operator; the account does not establish how many users connected through the infected nodes or whether their credentials or systems were compromised.
The removal also had a network-wide effect. The writer points to a visible drop in exit-relay metrics on Oct. 4 that had not recovered by the time of publication. That reduction may affect the available capacity for traffic leaving Tor, while marking relays BadExit helped prevent clients from selecting them for that purpose.
As an affiliate, we earn on qualifying purchases.
Testing and Response Timeline
The operator says they used Exitmap to test roughly 3,000 exit relays. The described check pinned a relay, routed an SSH connection between two servers through it, and compared the expected server fingerprint and connection source with what was observed. The account says some relays presented false fingerprints, while others redirected through the same interception servers without showing a fake fingerprint directly.
For further analysis, the writer says they used sshesame, an SSH honeypot, to observe how the interception system behaved. The report says this revealed use of Paramiko, a Python SSH library, and attempts to install Ebury through Perl. These technical observations support the writer’s account of the operation but do not, by themselves, establish who conducted it or how all affected machines were accessed.
The response unfolded over several days: the reported interception began Oct. 2; the Tor network health team contacted operators and the relays were marked BadExit on Oct. 4; and the account says all infected servers were down by Oct. 5. The Tor Project team was quoted as saying, “We’ve not seen an attack like that before.”
““We’ve not seen an attack like that before.””
— Tor Project network health team, as quoted in the operator’s report
As an affiliate, we earn on qualifying purchases.
What Investigators Have Not Established
The operator says the most significant unresolved issue is how attackers first gained access to the Linux servers. A hosting provider compromise was discussed as one possible explanation, but the report explicitly describes it as a theory rather than an established finding. It does not identify a confirmed entry point or provide an independent forensic account of the servers.
The report also does not identify the people or group behind the campaign. Its suggestion that the activity may have been financially motivated is based on the reported use of Ebury and collection of unencrypted data, and remains speculation. The number of users whose SSH sessions were intercepted, whether credentials were reused, and whether destination servers were successfully infected are not specified.
The operator cites a specialist’s concern that other Tor relays could be compromised, but the account does not establish that further infected nodes were found. It also does not provide a complete independent measure of the campaign’s duration or the total amount of data collected.
network security intrusion detection system
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Monitoring Relays and Securing SSH
The immediate response described in the report is complete: the affected relays were marked BadExit and the infected servers were shut down by Oct. 5. The account does not name a further investigation deadline or announce a public finding on the attackers’ initial access. Tor operators and users will need updates from the Tor Project or affected infrastructure providers to learn whether additional compromised systems are identified.
The operator advises users to disable SSH password authentication and use SSH keys. That is the writer’s security recommendation, not a finding that password authentication alone caused the compromise. Users who saw an unexpected host-key change should verify the server’s identity through a trusted channel before continuing a connection. Relay operators, meanwhile, may review their systems and configuration for signs of unauthorized changes, while treating any suspected compromise as a server-security incident.
The operator also encourages people to consider running Tor relays, but the account does not quantify how quickly the network’s exit capacity might recover. Further metrics and any investigation results would help clarify the lasting effect of the removals and whether the campaign reached other Tor infrastructure.
As an affiliate, we earn on qualifying purchases.
Key Questions
How many Tor exit nodes were affected?
The operator reports 333 compromised exit relays, roughly 10% of Tor’s approximately 3,000 exit relays at the time. These figures come from the operator’s account.
What happened to SSH connections through the affected relays?
The report says connections on port 22 were redirected to one of 12 SSH interception servers. The operator says the setup could expose passwords and allow attackers to observe commands if users proceeded past a changed-host-key warning.
Were the compromised relays removed from Tor?
The account says the Tor Project marked the affected relays BadExit on Oct. 4, preventing clients from using them to exit traffic, and that all infected servers were shut down by Oct. 5.
Who was behind the operation, and how did they get access?
Neither is known from the published account. A hosting-provider compromise is mentioned as a theory, and financial motivation is suggested, but neither is confirmed.
What should SSH users do if they see a host-key warning?
Do not ignore an unexpected SSH host-key change. Verify the server fingerprint through a trusted channel before reconnecting. The operator also recommends using SSH keys instead of password authentication.
Source: hn
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
