Compromised Management Server Used to Hijack 333 Tor Relays
Between October 2 and October 5, unknown actors hijacked 333 Tor exit nodes, redirecting SSH traffic and attempting to capture plaintext email through blocked encryption ports. arstechnica.com reported that the campaign began in late August when an attacker used a valid, reused password to gain administrative access to a Tor management server.
Installation of the Ebury Linux Backdoor
Once inside the management server, the attacker installed Ebury, a Linux backdoor originally discovered twelve years ago, according to arstechnica.com. The attacker then leveraged an RSA key that investigators could not locate among authorized keys to connect via SSH to a second Tor server named Switzerland2. Ebury was subsequently installed on Switzerland2, allowing the attacker to reconfigure settings on two exit nodes hosted by that server.
SSH Redirection and Interception Mechanics
While the full scope of how all underlying servers were compromised remains unestablished, the reconfigurations ultimately affected 333 exit relays. Tor users whose circuits happened to pass through these nodes experienced silent redirection. As Tor volunteer Kaba documented in an account published on arstechnica.com, encrypted web traffic forwarded normally, but connection attempts over Port 22 were covertly routed to one of twelve attacker-controlled interceptor servers.
If you happen to get a circuit that exits over one of those 333 infected exit nodes, you won’t notice anything at first.
Kaba wrote, describing the moment a host key change warning appeared during a routine Friday morning connection.
Users who bypassed the resulting host key mismatch warnings and entered their credentials handed their SSH passwords directly to the attackers. daily.dev noted that developers and administrators relying on Tor for secure shell access faced immediate exposure if they dismissed these cryptographic anomalies.
Targeted Disruption of Encrypted Mail Ports
In parallel with the SSH redirection, the compromised exit nodes were reconfigured to block ports 25, 465, 587, 993, and 995. These specific ports govern encrypted mail transmission and retrieval protocols, including secure SMTP, IMAP, and POP3 services. By choking off encrypted channels while keeping unencrypted ports open, the configuration changes aimed to force mail services into a protocol downgrade.
Investigators and volunteers partially mapped the initial server compromises and the email port filtering efforts during the early October window. However, arstechnica.com noted that it remains unclear whether any such downgrade attempts successfully captured plaintext email messages before the incident was mitigated.
