More than 300 Tor exit relays were reportedly compromised in a coordinated cyberattack that sought to intercept remote server administration sessions, steal login credentials and potentially capture unencrypted email traffic. According to the supplied report, attackers gained control of 333 Tor exit nodes between October 2 and October 5, 2026, redirecting Secure Shell (SSH) connections through infrastructure they controlled and deploying a Linux backdoor known as Ebury.
The incident has raised concerns about the security of systems connected through the Tor network. However, investigators have not yet established exactly how the attackers expanded their access across all the affected relays or confirmed whether readable email messages were successfully captured.
Reused Administrative Password Allegedly Enabled Initial Access
The reported intrusion began in late August, when an attacker allegedly accessed a primary Tor management server using a valid administrative password that had been reused.
After gaining entry, the attacker installed Ebury, a Linux malware family known for stealing credentials. The intruder then moved to another server identified as Switzerland2, reportedly using an RSA key that investigators could not find among the machine’s authorized keys.
Following the acquisition of root-level privileges on that server, the attackers installed Ebury again and modified the configuration files of two hosted exit relays.
These changes reportedly established the groundwork for a broader interception campaign. Investigators suspect that a commercial hosting provider responsible for multiple relays may have been compromised, potentially explaining how the operation spread. The report does not establish this as the confirmed route through which all 333 nodes were taken over.
The incident illustrates why organizations should treat reused passwords, unexpected authentication keys and poorly secured administrative servers as significant cybersecurity risks.
SSH Connections Redirected Through Attacker-Controlled Servers
Once the relays were compromised, the attackers reportedly redirected outbound SSH traffic to 12 dedicated interception servers.
SSH is widely used by system administrators to access remote machines and manage infrastructure securely. Although regular web browsing through the affected Tor exit nodes reportedly continued, SSH connections could be diverted into a man-in-the-middle interception process.
The attackers relied in part on users ignoring a critical security warning. When an SSH connection reached an unexpected destination, the client displayed an alert because the remote server’s cryptographic host key had changed.
A Tor volunteer identified as Kaba reportedly discovered the activity after receiving such a warning during a routine connection attempt.
Further investigation indicated that when users bypassed the warning, attackers could capture the passwords they entered, relay the session to its intended destination and observe commands issued during the connection. The attackers also reportedly attempted to establish secondary connections to infect remote systems with Ebury.
The host-key warning was therefore an important security signal. Unexpected changes should be investigated through a trusted channel rather than dismissed as routine connection problems.
Network Changes Targeted Encrypted Email Connections
The campaign reportedly extended beyond SSH traffic. Attackers modified network rules on compromised relays to block connections to several ports commonly associated with encrypted email services.
The affected ports included:
465 and 587: Commonly used for email submission, including encrypted connections.
993: Commonly used for IMAP mailbox access over TLS.
995: Commonly used for POP3 mailbox access over TLS.
25: Primarily used for SMTP mail transfer between mail servers.
According to the report, the attackers blocked these connections while allowing unencrypted traffic to pass. The apparent objective was to encourage some email clients to fall back to less secure transmission methods.
If a client switched to plaintext communication, messages passing through the malicious infrastructure could potentially be recorded and stored by the attackers.
However, investigators have not confirmed whether email clients actually downgraded their connections or whether any readable email messages were successfully stolen. The distinction is important because a technique intended to expose data does not, by itself, establish that the data was accessed.
Detection Efforts Helped Map the Operation
The operation reportedly ended after Kaba deployed detection scripts and a honeypot across approximately 3,000 Tor exit nodes.
These measures helped identify suspicious destinations, isolate the 12 interception servers and examine how the Ebury deployment process operated.
The investigation has nevertheless left important questions unanswered, including how the attackers extended their control to hundreds of relays and whether additional systems or user accounts were affected.
The case also demonstrates that privacy infrastructure can be exposed to risks beyond weaknesses in its underlying software. Administrative credentials, hosting-provider security and server configuration can all influence the security of systems operating within a distributed network.
Security Lessons for Administrators and Email Users
The reported campaign highlights several practical security considerations for organizations that manage remote infrastructure or handle sensitive communications.
Administrators should use unique passwords, strengthen authentication controls and review authorized SSH keys regularly. Unexpected host-key changes should be verified before a connection proceeds, particularly when accessing production servers or systems containing sensitive information.
Organizations should also ensure that email clients require properly encrypted connections rather than silently falling back to plaintext transmission. Security monitoring can help identify unusual connection patterns, configuration changes and suspicious authentication activity.
For businesses reviewing potential exposure to credential theft or suspicious financial activity following a cyber incident, appropriate financial investigation services may help support the examination of relevant records and transactions.
Conclusion
The compromise of 333 Tor exit nodes represents a reported attempt to exploit trusted network infrastructure to intercept administrative credentials and potentially expose email communications. The use of Ebury, SSH traffic redirection and changes to email-related network rules suggests a campaign targeting multiple layers of system security.
While detection efforts reportedly helped identify the rogue destinations and disrupt the operation, the full scope of the intrusion remains uncertain. Confirmation of any stolen credentials, successfully intercepted email or infected remote systems will depend on further investigation.