Security researchers have uncovered a major breach of the Tor network involving the compromise of 333 exit nodes, enabling attackers to intercept SSH login attempts and harvest credentials. The incident, active since October 2, 2026, also affected unencrypted email traffic in what appears to be an expansive campaign. Roughly 10% of Tor’s ~3,000 exit relays were involved. In August, attackers inserted a Linux backdoor named Ebury 1.8.3—designed to steal credentials—into several exit servers.
How the Attack Worked
The compromised relays handled encrypted web requests normally, but any SSH connections on port 22 were diverted to one of twelve malicious interception servers. This led to discrepancies in SSH host keys: users saw “REMOTE HOST IDENTIFICATION HAS CHANGED” warnings, indicating that the server presented a different key than expected. Users who dismissed the warning and opted to log in with a password unwittingly exposed their credentials. From there, attackers could access the intended destination, observe session activity, and attempt to further deploy Ebury.
Additionally, altered port permissions on these exit nodes caused some unencrypted email traffic to be rerouted and exposed. The researcher who discovered the activity used tools like exitmap to test various exit relays. Connections through some nodes returned false SSH fingerprints, or were redirected through the attack infrastructure. A honeypot using sshesame revealed that the attacker’s setup used the Paramiko Python SSH library, evaluated whether users had sudo privileges, and attempted to install a Base64-encoded Perl payload.
Response & Unresolved Questions
The researcher notified Tor’s health team on October 2. By October 4, affected relays were flagged with a BadExit status, preventing them from serving as exit nodes. Most compromised servers were shut down by October 5, though attackers reportedly rebooted several relays after flagging. How the attackers initially breached the servers remains unconfirmed; a hosting provider compromise is one theory under consideration.
Tor’s BadExit flag is designed to stop a relay judged unsafe from functioning as an exit. The project continues to accept reports including relay identifiers and evidence of misbehavior.
What Users Can Do
SSH users are urged to heed host-key warnings rather than bypass them. Switching from password-based logins to cryptographic public-key authentication significantly reduces risk. Monitoring tools and threat intelligence systems also play a crucial role in detecting similar compromise at scale.
This incident underscores the persistent dangers present even on privacy-focused infrastructure like Tor. Attackers didn’t need to break SSH encryption; they merely needed to manipulate network routing and trust perceptions. Users who ignore mismatched SSH fingerprints expose themselves to credential theft and potential server compromise.
Why this matters: The attack shows exit node security is a weak link — encryption alone isn’t enough. Vigilance, proper SSH key management, and relay health monitoring must be central to threat modeling. Keep an eye on how Tor responds over the long term: whether new hardening steps are deployed, exit relay auditing becomes more real-time, and whether this raises calls for overhauling trust in relays altogether.
