A coordinated compromise of more than 300 Tor exit nodes has exposed users to SSH credential theft and plaintext email interception, according to research published Tuesday by a Tor volunteer known as Kaba. The campaign, which ran from October 2 to October 5, saw attackers reconfigure exit relays to redirect SSH traffic through attacker-controlled servers and to block ports used for encrypted email while leaving unencrypted ports open.

The intrusion began in late August when an attacker gained access to a Tor management server using a valid but reused password. From there, the attacker installed Ebury, a Linux backdoor first discovered 12 years ago, and then moved laterally to a second Tor server dubbed Switzerland2 via SSH. Investigators found that Switzerland2 accepted an RSA key that was not present among its authorized keys, a detail that remains unexplained. With administrative control of Switzerland2, the attackers installed Ebury there as well and reconfigured settings on two exit nodes hosted on that server. Ultimately, 333 exit relays were involved, though investigators have not determined how the attackers gained control of all the underlying servers.

SSH Redirection and Email Downgrade Attempts

The attackers made two distinct sets of configuration changes. One redirected SSH traffic traversing Tor to one of 12 interceptor servers they controlled. When a Tor user attempted an SSH connection over port 22 and ignored the host-key-changed warning, the attackers captured the SSH password, opened a connection to the intended server to observe typed commands, and then opened a second connection to infect that server with Ebury. Kaba experienced this firsthand on a Friday morning, receiving the familiar "REMOTE HOST IDENTIFICATION HAS CHANGED" warning that many users routinely dismiss.

The second set of changes caused the exit nodes to block ports 25, 465, 587, 993, and 995—ports used for encrypted email submission and retrieval—while continuing to allow ports for unencrypted email. If email services downgraded connections, the attackers could use their position on the exit nodes to obtain unencrypted messages. It is unclear whether any such downgrade attempts succeeded.

Investigation and Open Questions

To assess the scope, Kaba wrote a script that polled all of Tor's roughly 3,000 exit nodes, checking whether each returned a correct SSH fingerprint from a test server. The test server then determined whether the connection originated from a pinned exit node or one of the 12 interception servers. Kaba also set up a honeypot to observe the interception software attempting to log in and install Ebury.

Several mysteries remain. Tor volunteers still do not know how the attackers accessed so many servers. One possibility is that a hosting company was compromised, but that theory is inconclusive. The identity of the attackers is also unknown. Kaba wrote that the use of Ebury and the broad collection of unencrypted data point to a financially motivated crime group, though that too is speculation. A final perplexing finding is why Switzerland2 accepted an RSA key when there was no evidence it was an authorized SSH certificate.

Defensive Lessons

The campaign underscores the importance of defense in depth. Organizations and individuals should configure email accounts to accept only encrypted traffic and reject unencrypted ports. Disabling password authentication in favor of SSH keys is another critical measure. Tor users should also heed host-key warnings rather than dismissing them, as doing so in this case handed attackers both credentials and a foothold on destination servers.

The incident highlights the persistent risk posed by reused credentials and legacy backdoors, and it demonstrates how a single compromised management server can cascade into hundreds of malicious exit nodes. Tor volunteers continue to investigate the full scope of the compromise and the identity of the attackers.