333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email

Unknown attackers hijacked 333 Tor exit nodes earlier this month, reconfiguring them to intercept SSH connections and target unencrypted email traffic, according to a researcher's report published Tuesday. The multi-day campaign ran from October 2 to October 5. Attackers began by compromising a Tor management server in late August using a reused password, then installed Ebury, a 12-year-old Linux backdoor.

From there, they accessed a second Tor server named Switzerland2 and ultimately gained control of the exit nodes. The compromised exit nodes performed two main functions. They redirected Secure Shell (SSH) traffic—a protocol used for secure remote computer login—to 12 attacker-controlled servers, logging typed commands and passwords if users ignored host-key warnings.

Simultaneously, the nodes blocked encrypted email ports while permitting unencrypted traffic, though it remains unconfirmed if any downgrade attempts succeeded. Tor volunteers and investigators have not yet determined how all underlying servers were breached, or who is behind the operation. However, the deployment of Ebury and the focus on unencrypted data suggest a financially motivated crime group, according to the researcher.