Skip to content
Over 300 Tor Exit Nodes Compromised in SSH Interception Attack

Over 300 Tor Exit Nodes Compromised in SSH Interception Attack

First seen 20 Oct 2026, 22:20 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 20, 2026 at 23:46 UTC
  • •333 Tor exit nodes were compromised, affecting about 10% of the network.
  • •Attackers used Ebury 1.8.3 to intercept SSH connections and steal data.
  • •The Tor Project successfully shut down the infected nodes within days of discovery.

On October 2, 2026, 333 infected Tor exit nodes began a coordinated campaign to intercept SSH connections and collect unencrypted data. The attackers had gained access to these nodes two months prior, deploying the Ebury 1.8.3 payload, which is an OpenSSH backdoor and credential stealer for Linux. The attack redirected SSH connections to 12 interception servers, allowing attackers to observe commands and infect servers with the Ebury malware. The Tor Project's network health team confirmed the attack and worked to shut down the compromised nodes, which were marked as BadExit. By October 5, all infected servers were taken down, but the attackers attempted to restart some relays. The incident resulted in a noticeable dip in Tor's exit node metrics, indicating a significant impact on the network's health.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-02
Attack on Tor exit nodes began
333 infected exit nodes started intercepting SSH connections to gather unencrypted data.
News.Ycombinator
2026-10-04
Tor Project announced attack
The Tor network health team informed relay operators about the attack and began shutting down the infected nodes.
News.Ycombinator
2026-10-05
Infected servers taken down
All infected servers were shut down, with some attempts by attackers to restart relays that were already flagged.
News.Ycombinator

More articles in this cluster (6)

Following this threat?

Track Ebury and Tor Project in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (14)

1 / 4

Common questions

How many exit nodes were affected?
A total of 333 Tor exit nodes were compromised, representing about 10% of the network.
What was the attack method?
Attackers used a man-in-the-middle (MITM) technique to intercept SSH connections and deploy malware.
What actions were taken by the Tor Project?
The Tor Project's network health team identified the attack and worked to shut down the infected exit nodes quickly.