More than 300 Tor exit relays were hijacked in early October to intercept SSH logins made over Tor and harvest passwords; one operator found the Ebury 1.8.3 OpenSSH backdoor on his servers, and the Tor Project had removed all affected relays by 5 October
Attackers took over more than 300 Tor exit relays between 1 and 5 October 2026 and rewrote their exit policies to carry SSH (port 22) and plaintext mail, so that SSH connections made through Tor were redirected to 12 interception servers that could capture passwords. A researcher publishing as kaba noticed a changed host-key warning on 2 October, scanned all of Tor's roughly 3,000 exits that day and found 333 redirecting SSH to the same interception servers; he reported it to the Tor Project's network health team, which also spotted the policy change. Directory authorities flagged affected relays BadExit and MiddleOnly from 18:00 UTC on 4 October, and by 17:00 UTC on 5 October no relay with the attacker's policy remained in the consensus. A directory-data analysis on the tor-relays list counts 377 relays from 59 operators that switched to the attacker's policy between 1 and 4 October (about 7.46% of exit capacity at the peak), many hosted at FranTech/BuyVM. Only password logins could be stolen: a user had to connect to an SSH server over Tor in that window, hit one of the hijacked exits, accept the interceptor's host key and type a password; key-based logins cannot be relayed this way. The interceptor passed the session through to the real server, watched commands and could log in separately with the stolen password to check sudo and run an installer. Relay operator Zimmer (Quetzalcoatl family) wrote in a post-mortem on 7 October that two of his servers had been running the Ebury 1.8.3 OpenSSH backdoor since 28 August, after an attacker logged in with a reused password over SSH password authentication; this Ebury version is newer than ESET's published indicators. No victim count exists and who is behind the campaign is unknown. Primary: Tor Project notice to relay operators (5 Oct) and kaba's write-up (20 Oct); wire: The Hacker News (21 Oct).
- Product
- Tor exit relays (Linux hosts); OpenSSH password logins made over Tor; Ebury 1.8.3 OpenSSH backdoor
- Versions
- n/a — campaign; affected window 1–5 October 2026 (affected relays out of the Tor consensus by 17:00 UTC on 5 Oct)
- Exploited in Australia?
- unknown
- Patch to
- If you logged in to an SSH server over Tor with a password between 1 and 5 October and accepted a new or changed host key, treat that password as stolen: change it, review the server for unknown users, authorized_keys entries, cron jobs and systemd units, and check for Ebury (an unpackaged setuid /usr/lib/x86_64-linux-gnu/libkeyutils.so.1.10.2 with libkeyutils.so.1 pointing to it; dpkg -V and debsums will not catch it). Use key-based SSH and disable password authentication on internet-facing servers. Tor relay operators: check Relay Search and torrc (and included files) for ExitRelay, ExitPolicy, ContactInfo, MyFamily or Nickname changes you did not make, and follow the Tor Project's notice.
Primary: kaba — How I got over 300 Tor exit nodes removed (researcher write-up, 20 Oct 2026) · Vendor: Tor Project — Security incident affecting some relay operators (tor-relays list, 5 Oct 2026) · The Hacker News — Attackers hijacked over 300 Tor exit relays to intercept SSH connections (21 Oct 2026)