Key points
- Tor exit nodes were compromised, representing roughly ten percent of the network’s exits.
- The compromise involved redirecting SSH port 22 traffic to interception servers.
- The attack used a paramiko-based man-in-the-middle tool to steal passwords.
- The goal was to attempt to drop Ebury malware on the targeted remote servers.
The short version
- A researcher reported that 333 Tor exit nodes were compromised to intercept SSH connections.
- The attack redirected port 22 traffic to servers running man-in-the-middle software.
- The intercepted sessions were used to steal passwords and attempt to drop Ebury.
- The researcher credited with the report stated they had these nodes removed.
The details
On October 2, a significant portion of the Tor network’s exit nodes began behaving maliciously. According to a report posted to the r/netsec community by user /u/kabakaba0, approximately 333 exit nodes were involved in this activity. This group represented nearly ten percent of all active exit nodes at the time. The compromised nodes were not simply passing traffic through; they were actively intercepting specific connections.
The attack focused exclusively on SSH traffic, which uses port 22. When a user attempted to connect to a remote server through one of these compromised exit nodes, the connection was redirected. The traffic was sent to one of 12 interception servers instead of the intended destination. These servers were running software based on Paramiko, a Python library for SSH. This setup allowed the attackers to perform a man-in-the-middle attack.
During these intercepted sessions, the attackers stole passwords from the users. The ultimate objective was to try to drop Ebury, a known banking and server trojan, on the target machines. The researcher who identified the issue stated that they got the compromised nodes removed from the network. The report details the mechanism of the interception but does not name the group responsible for the initial compromise of the exit nodes.
The context
Tor exit nodes are the final hop in the Tor circuit, connecting to the regular internet on behalf of the user. Compromising these nodes allows attackers to see unencrypted traffic leaving the Tor network. While Tor protects the user’s identity, it does not encrypt the traffic between the exit node and the destination server unless the application layer (like HTTPS or SSH) is encrypted.
SSH is designed to prevent man-in-the-middle attacks through certificate verification. However, if a user does not verify the host key, or if the attacker can manipulate the key exchange, credentials can be stolen. The attempt to drop Ebury suggests a financial or infrastructure-focused motive, as this malware is known for targeting banks and corporate servers. The scale of the compromise, affecting ten percent of exits, indicates a large-scale operation.
What to watch
- Monitor for unexpected SSH host key changes when connecting via Tor.
- Watch for reports of new Ebury variants or command-and-control infrastructure.
- Check if any internal services were accessed through compromised exit nodes.
- Observe Tor network announcements for changes to exit node policies.
What it means for organisations
Organisations should treat this as a reminder that transport-layer encryption alone is insufficient if endpoint verification is neglected. Teams usually need to audit their remote access policies to ensure that SSH host keys are strictly validated. Check whether any developers or staff use Tor for legitimate remote administration, as this vector exposes them to interception.
Security leaders should inform engineering teams about the risk of credential theft during SSH sessions. This event highlights the importance of multi-factor authentication, which can mitigate the impact of stolen passwords. It also underscores the need to monitor for unauthorized software installations on remote servers, such as Ebury. Operational resilience depends on verifying the integrity of every connection, not just relying on the network path.
Background: Encryption
Encryption is the process of converting plain text into ciphertext using an algorithm and a key. It prevents unauthorized access to data at rest and in transit. Without the correct decryption key, the information remains unintelligible, protecting privacy and integrity against interception or theft.
Read the full guide: What Is Encryption: Meaning, Definition, and How It Works
What to do and how to stay safe: Tor
- Enforce strict SSH host key verification for all remote connections, especially when using public proxies.
- Implement multi-factor authentication for SSH access to render stolen passwords less useful.
- Monitor server logs for unusual login patterns or installation of unknown software.
- Consider using internal jump boxes instead of direct public internet connections for administration.
Step-by-step guide: HTTPS Configuration Checklist for Secure Web Endpoints
General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many Tor exit nodes were involved in this attack?
Approximately 333 exit nodes were compromised, which represented about ten percent of the total.
What type of traffic was being intercepted?
The attack specifically targeted SSH traffic, which operates on port 22.
What malware was the attacker trying to install?
The attackers were attempting to drop Ebury, a known server and banking trojan.
Who reported this incident?
The incident was reported by user /u/kabakaba0 on the r/netsec subreddit.
