Attackers Hijack 333 Tor Exit Nodes to Intercept SSH Traffic

Attackers hijacked 333 Tor exit nodes in early October 2026, comprising approximately 10% of the network's total exit relays[1][2]. This allowed them to intercept SSH traffic and potentially access plaintext email for users of the privacy network[1].

This incident directly targeted the anonymity and security Tor provides. Users who accessed services like SSH through the compromised nodes faced a risk of having their login credentials stolen if they ignored security warnings, which undermines trust in the network's protective capabilities[2][4][6].

What the records show

The attackers gained access to underlying Linux servers and deployed the Ebury 1.8.3 OpenSSH backdoor, a tool designed to steal credentials[2][6][8]. This campaign likely began in August 2026, with the backdoor quietly deployed around that time[2]. Once the servers were compromised, the attackers modified the torrc configuration files on these relays[3][7][9]. This modification rewrote exit policies, specifically enabling port 22 for SSH traffic, which allowed for the interception of SSH connections[3][7]. The attackers also converted some regular relays that were not initially exit nodes into exit nodes, expanding their reach[3][4][7][9]. In many instances, these changes also closed encrypted mail ports, such as IMAPS and POP3S, making plaintext email more accessible[3].

The timeline

In August 2026, attackers gained server access and deployed the Ebury backdoor[2]. On October 2, 2026, security researcher "kaba" discovered the malicious activity, observing 333 infected exit nodes beginning a coordinated campaign to redirect SSH connections to attacker-controlled interception servers[2][3][4]. The researcher scanned Tor's roughly 3,000 exit relays and identified those redirecting SSH traffic[3]. Kaba notified the Tor Project's network health team of the findings that same evening[4]. The Tor Project received reports of hacked machines and edited torrc files over the weekend of October 3–4[7]. By October 4, 2026, the Tor Project began flagging the compromised relays[3]. The project officially confirmed the incident on October 5, 2026, and removed all affected relays from the network's consensus, the list of relays Tor clients use[3]. The hacking campaign went undetected for three days, between October 2 and 5[5].

What changed and for whom

For the Tor network, 333 relays, approximately 10% of its total, were compromised and subsequently removed from service[1][2][3]. For users, those making SSH connections through compromised nodes were at risk of credential theft if they ignored host key warnings[2][4][6]. The Tor Project urged Linux relay operators to audit their servers after the attack[7].

What the subject has said publicly

The Tor Project's network health team stated in an October 5 notice to relay operators that "It seems the attacker is gaining access to Linux based hosts and when these machines are running non-exits they are editing the torrc file and turning them into exits to be able to carry out the SSH attack"[3]. An October 5 advisory from The Tor Project confirmed that hacked Linux hosts were intercepting SSH traffic[4]. The organization also urged Linux relay operators to audit their servers[7].

What we could not confirm

We could not confirm the identity of the attackers responsible for the hijack[5]. The total number of users whose credentials or plaintext emails were compromised remains unconfirmed. We also could not confirm the specific geographic distribution of the compromised servers.