TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A Tor operator reports that a scan identified 333 compromised exit relays involved in an SSH interception campaign that began on October 2, 2026. The Tor Project’s network health team contacted operators, and the relays were marked BadExit on October 4; the initial route of compromise and the attackers’ identities remain unknown.
A Tor operator says a scan identified 333 compromised exit relays that were redirecting SSH connections through attacker-controlled servers, prompting the Tor Project and relay operators to take them out of exit service. The campaign began on October 2, 2026, and affected roughly 10% of Tor’s approximately 3,000 exit relays, according to the operator’s account published October 20.
The operator said the attackers had gained access to the affected Linux servers in August and installed Ebury 1.8.3, which the report describes as an OpenSSH backdoor and credential stealer. On October 2, the compromised relays began redirecting SSH traffic on port 22 to 12 interception servers. The account says encrypted web traffic continued to pass normally, while the attack also sought to collect unencrypted email traffic by blocking selected ports.
The operator detected the SSH interception after an SSH client warned that the remote host’s key fingerprint had changed. The report says that proceeding past the warning could expose a password, allow an attacker to observe commands through a man-in-the-middle connection, and lead to an attempt to infect the destination server with Ebury. The operator says they contacted the Tor Project’s network health team on Friday evening with the findings.
According to the timeline in the report, the Tor team alerted relay operators on October 4 and the affected relays were marked BadExit, preventing Tor clients from selecting them to exit traffic. The attackers restarted many relays the next day, but those already flagged could serve only as middle relays. By October 5, the report says, all infected servers had been shut down, partly by their operators and partly by the attackers.
The reported scale matters because exit relays connect Tor circuits to destinations on the public internet. The operator estimated that the 333 affected relays represented about one-tenth of Tor’s exit relays at the time. The report says Tor’s public metrics showed a clear decline in exit relays on October 4 that had not recovered by the time of publication.
The incident also shows a practical limit of Tor’s protections: Tor can obscure a user’s network path, but it does not make an unencrypted application connection safe from a malicious exit. An SSH host-key warning can signal an interception attempt. The operator’s account advises users to treat such warnings seriously and recommends SSH keys instead of password authentication; that recommendation is security advice, not evidence that every user or relay was affected.
As an affiliate, we earn on qualifying purchases.
How the Relays Were Identified
The operator says they used exitmap to test roughly 3,000 exit relays. The script pinned a relay and compared the SSH fingerprint received by one test server with the expected fingerprint from another. About a dozen relays returned a fake fingerprint, while more than 300 redirected connections through the same interception infrastructure without directly presenting a fake fingerprint. The operator says that redirection was enough to identify those relays as compromised.
For further analysis, the operator used the SSH honeypot tool sshesame. They report that interactions with the interception system indicated use of Paramiko, a Python SSH library, and attempts to install Ebury using Perl. These technical details come from the operator’s account; the source material does not provide an independent forensic report covering every infected server.
The Tor network health team’s announcement, quoted in the report, described a pattern in which an attacker gained access to Linux hosts and changed their Tor configuration to make them exit relays. The team’s response involved contacting operators, who could shut down affected servers, while Tor’s BadExit designation prevented clients from using flagged relays for exit traffic.
“We’ve not seen an attack like that before.”
— Tor Project network health team, as quoted in the operator’s report
As an affiliate, we earn on qualifying purchases.
The Initial Intrusion Remains Unknown
The operator says investigators have not established how the attackers first accessed the servers. A possible compromise of a hosting company was discussed, but the report explicitly describes that as a theory rather than a confirmed cause. It also does not identify who was behind the operation. The suggestion that the activity was financially motivated, based on Ebury’s use and collection of unencrypted data, is presented as speculation.
The number of affected relays and the testing method are reported by the operator, but the material supplied does not include an independent accounting of each server or a public forensic assessment of the full campaign. It is also unclear whether other Tor relays remain compromised. Léveillé’s comment points to the historical presence of Ebury on many servers, but that figure does not establish that additional Tor relays were infected in this incident.
network security monitoring devices
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Relay Operators Face Continued Checks
The immediate response described in the report was completed by October 5, when the infected servers had been shut down. The next steps depend on continued investigation by the Tor Project and relay operators, including determining how the attackers gained access and whether any other relays were affected. The report does not give a date for a further public update or describe a completed investigation into the initial intrusion.
Operators and users can act on the confirmed warning signs without assuming the full extent of the campaign is known. The operator recommends strong server security and disabling SSH password authentication in favor of keys; users who encounter an unexpected host-key change should verify it with the server administrator rather than disregard the warning. The Tor Project’s relay setup materials are also cited in the report for people interested in operating relays, though running one carries maintenance and security responsibilities.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did the compromised Tor relays do?
According to the operator’s report, they redirected SSH connections on port 22 through 12 interception servers. The report says attackers could steal passwords, observe commands, and attempt to install Ebury on destination servers if users continued past a changed host-key warning.
How many relays were affected?
The operator reports identifying 333 compromised exit relays by testing roughly 3,000. They estimate that was about 10% of Tor’s exit relays at the time. The supplied material does not include an independent count.
How were the relays taken out of service?
The Tor Project’s network health team contacted relay operators, and the affected relays were marked BadExit on October 4, 2026, so clients would not use them to exit traffic. The report says the infected servers were shut down by October 5.
Who was responsible, and how did the attackers get in?
Neither point is established in the report. A hosting-company compromise was suggested as one possibility, and financially motivated activity was proposed as a possible explanation, but both remain unconfirmed.
What should users do if SSH reports a changed host key?
Do not dismiss the warning without checking. The report recommends verifying the fingerprint with the server administrator and using SSH keys rather than password authentication. The warning can also result from legitimate host-key changes, so it should be investigated rather than treated as proof of an attack.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
