Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections

Roughly 10% of Tor Exit Capacity Turned Against SSH Users

Attackers took control of more than 300 Tor exit relays in early October 2026 and used them to redirect SSH connections to servers built to steal login passwords. Most reports count 333 relays, about 10% of Tor's roughly 3,000 exit relays, while The Hacker News cites 342 relays that had port 22 newly opened. The activity was found by a researcher who goes by kaba after an SSH session through Tor raised a "REMOTE HOST IDENTIFICATION HAS CHANGED" warning.

Details

What Happened

Reporting indicates the attackers gained access to the underlying Linux servers in August and installed Ebury, a long-running OpenSSH backdoor and credential stealer. On October 2 they began editing the relays' torrc files so the exit policy allowed port 22. That enabled SSH exiting on relays that had previously blocked it, and 24 non-exit relays became exits.

SSH connections leaving through a compromised relay were sent to one of 12 interception servers instead of the intended destination. The same change reportedly closed the encrypted mail ports (IMAPS and POP3S) and, on most relays, opened plaintext POP3 and IMAP.

The Tor Project began flagging the relays on October 4, and by October 5 none remained in the network consensus.

Who Was at Risk

Only a password login to an SSH server, made through Tor between October 1 and 5 and after the user accepted the interception server's host key, could have been captured. With the password in hand, attackers could connect to the real server, watch the commands entered, and try to install Ebury through a separate connection. The number of victims is unknown.

Impact Assessment

Recommendations

For IT Admins

• Enforce key-based SSH authentication and disable password logins on internet-reachable servers
• Treat any unexpected host-key change as a possible interception, not a nuisance, and investigate before connecting
• Rotate credentials for any server reached by password over Tor between October 1 and 5, 2026

For Security Teams

• Review SSH logs for logins from Tor exit addresses in that window and for follow-up sessions from unfamiliar sources
• Hunt for Ebury indicators on servers whose credentials may have been exposed

For Relay Operators

• Investigate from a rescue system or offline disk image rather than the running host
• Log in with a key rather than typing passwords on a machine that may be compromised

Key Takeaways

1. Host-key warnings matter — the whole campaign was caught because one SSH client refused a changed host key
2. Password logins were the exposed path — key-based authentication would not have leaked a reusable secret
3. The Tor Project responded within days — flagging began October 4 and the relays were out of consensus by October 5
4. Open questions remain — how the relays were first compromised and who is behind it are still unknown

Sources

• Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections — The Hacker News
• Hackers Hijack 333 Tor Exit Nodes to Intercept SSH Logins and Steal Credentials — Cybersecurity News
• Risky Bulletin: Hacker hijacks 10% of Tor exit nodes
• How I got over 300 Tor exit nodes removed — kaba