# Attackers Hijack 333 Tor Exit Nodes to Intercept SSH Traffic

> In early October 2026, attackers compromised 333 Tor exit nodes, roughly 10% of the network, to intercept SSH connections and potentially access plaintext email.

By PrimaryBrief newsroom · Published 2026-10-22T12:05:02.452570Z
Canonical: https://primarybrief.com/article/attackers-hijack-333-tor-exit-nodes-to-intercept-ssh-traffic-b6ad7585

Attackers hijacked 333 Tor exit nodes in early October 2026, comprising approximately 10% of the network's total exit relays [1][2]. This allowed them to intercept SSH traffic and potentially access plaintext email for users of the privacy network [1].

This incident directly targeted the anonymity and security Tor provides. Users who accessed services like SSH through the compromised nodes faced a risk of having their login credentials stolen if they ignored security warnings, which undermines trust in the network's protective capabilities [2][4][6].

## What the records show

The attackers gained access to underlying Linux servers and deployed the Ebury 1.8.3 OpenSSH backdoor, a tool designed to steal credentials [2][6][8]. This campaign likely began in August 2026, with the backdoor quietly deployed around that time [2]. Once the servers were compromised, the attackers modified the `torrc` configuration files on these relays [3][7][9]. This modification rewrote exit policies, specifically enabling port 22 for SSH traffic, which allowed for the interception of SSH connections [3][7]. The attackers also converted some regular relays that were not initially exit nodes into exit nodes, expanding their reach [3][4][7][9]. In many instances, these changes also closed encrypted mail ports, such as IMAPS and POP3S, making plaintext email more accessible [3].

## The timeline

In August 2026, attackers gained server access and deployed the Ebury backdoor [2]. On October 2, 2026, security researcher "kaba" discovered the malicious activity, observing 333 infected exit nodes beginning a coordinated campaign to redirect SSH connections to attacker-controlled interception servers [2][3][4]. The researcher scanned Tor's roughly 3,000 exit relays and identified those redirecting SSH traffic [3]. Kaba notified the Tor Project's network health team of the findings that same evening [4]. The Tor Project received reports of hacked machines and edited `torrc` files over the weekend of October 3–4 [7]. By October 4, 2026, the Tor Project began flagging the compromised relays [3]. The project officially confirmed the incident on October 5, 2026, and removed all affected relays from the network's consensus, the list of relays Tor clients use [3]. The hacking campaign went undetected for three days, between October 2 and 5 [5].

## What changed and for whom

For the Tor network, 333 relays, approximately 10% of its total, were compromised and subsequently removed from service [1][2][3]. For users, those making SSH connections through compromised nodes were at risk of credential theft if they ignored host key warnings [2][4][6]. The Tor Project urged Linux relay operators to audit their servers after the attack [7].

## What the subject has said publicly

The Tor Project's network health team stated in an October 5 notice to relay operators that "It seems the attacker is gaining access to Linux based hosts and when these machines are running non-exits they are editing the torrc file and turning them into exits to be able to carry out the SSH attack" [3]. An October 5 advisory from The Tor Project confirmed that hacked Linux hosts were intercepting SSH traffic [4]. The organization also urged Linux relay operators to audit their servers [7].

## What we could not confirm

We could not confirm the identity of the attackers responsible for the hijack [5]. The total number of users whose credentials or plaintext emails were compromised remains unconfirmed. We also could not confirm the specific geographic distribution of the compromised servers.

## Evidence cited
1. 300 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email (arstechnica.com) — https://arstechnica.com/information-technology/2026/10/300-tor-exit-nodes-hijacked-to-intercept-ssh-traffic-and-retrieve-plaintext-email/
2. Home KABA.CX. How I got over 300 Tor exit nodes removed. — https://kaba.cx/
3. Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections. (thehackernews.com) — https://thehackernews.com/
4. Tor removes hundreds of compromised relays used to hijack SSH logins (cyberinsider.com) — https://cyberinsider.com/
5. Risky Bulletin: Hacker hijacks 10% of Tor exit nodes (risky.biz) — https://risky.biz/
6. Hackers Hijack 333 Tor Exit Nodes (cybersecuritynews.com) — https://cybersecuritynews.com/
7. Tor Project Urges Linux Relay Operators to Audit Servers After SSH Interception Attack (cyberkendra.com) — https://cyberkendra.com/
8. Attackers Compromised 333 Tor Exit Nodes to Steal SSH Credentials and Deploy Ebury Backdoor (gbhackers.com) — https://gbhackers.com/
9. Tor Network Suffers Major Attack: 333 Exit Nodes Compromised to Intercept SSH Traffic (cyberpress.org) — https://cyberpress.org/