Hackers Compromise 333 Tor Exit Nodes to Intercept SSH and Unencrypted Email Traffic

Image: Ars Technica · Source

Over three days in October 2026, attackers hijacked 333 Tor exit nodes, redirecting SSH connections to malicious servers and enabling interception of unencrypted email, exploiting weaknesses in password reuse and server security, according to researcher reports.

In early October 2026, a large-scale security breach affected the Tor network, with unknown attackers hijacking 333 Tor exit nodes over a period of three days. The attackers manipulated these nodes to intercept SSH traffic and capture unencrypted email communications, as detailed by a Tor volunteer known as Kaba and reported by Ars Technica.

Initial compromise began in late August when the attackers gained access to a Tor management server by using a valid, reused password. They installed a Linux backdoor known as Ebury, a threat discovered more than a decade ago, enabling persistent control. From this management server, they connected via SSH to another Tor server, Switzerland2, utilizing an RSA key whose authorization status remains unexplained. Control over Switzerland2 allowed them to install Ebury there and manipulate configurations on two exit nodes hosted by this server.

Ultimately, 333 exit relays were altered. The attackers reconfigured these nodes to redirect SSH connections over port 22 to one of twelve attacker-controlled servers. Users who ignored SSH host key change warnings would inadvertently provide their passwords. This enabled the attackers to capture login credentials, observe all typed commands, and subsequently infect the targeted servers with the Ebury backdoor.

In addition, the compromised exit nodes blocked encrypted email ports (25, 465, 587, 993, and 995) while permitting unencrypted email traffic. This arrangement attempted to coerce email services into downgrading to unencrypted connections, allowing attackers potential access to plaintext messages. However, it remains unclear if such downgrades occurred successfully.

Kaba developed tools to monitor the network, polling all approximately 3,000 Tor exit nodes to detect the manipulated SSH fingerprints and deploying a honeypot that observed the attackers attempting logins and installations. Despite these efforts, several open questions persist: the exact method of the attackers’ broad server access remains unknown, as does the rationale behind Switzerland2 accepting an unauthorized RSA key. Attribution is also uncertain, though the use of Ebury and targeting unencrypted data suggest a financially motivated criminal group.

This incident highlights critical security lessons for Tor users and operators. Strong password hygiene is essential, as is disabling password-based SSH authentication in favor of more secure SSH keys. Email providers and users should configure their systems to reject unencrypted connections to prevent data interception. The event underscores the importance of defense in depth to combat large-scale network compromises and protect sensitive communications over anonymity networks such as Tor.