In early October 2026, a significant security incident affected the Tor network when approximately 333 exit relays—roughly 10% of all active Tor exit nodes at the time—were discovered to be part of a coordinated attack. The perpetrators had gained access to these Linux-based hosts as early as August, quietly deploying the Ebury payload (a known OpenSSH backdoor and credential stealer). Once active, the compromised nodes were configured to specifically intercept traffic targeting Port 22 (the standard port for Secure Shell or SSH) while forwarding other encrypted web traffic normally.

The mechanism of the attack relied on redirecting users who attempted an SSH connection through one of the infected exits toward one of 12 dedicated interception servers. If a user ignored the 'Remote Host Identification Has Changed' warning—which indicates that the server's fingerprint does not match what the client expects—the attacker could perform three actions: capture the user's password, observe typed commands in real-time via a Man-in-the-Middle (MITM) setup using the Paramiko Python library, and attempt to infect the target machine with the Ebury malware. To facilitate this, attackers modified the `torrc` files on non-exit machines to turn them into exits capable of carrying out the SSH redirection.

Diagram illustrating the attacker infrastructure for the SSH interception attack
A conceptual diagram of the infrastructure used to redirect SSH traffic to interception servers.kaba.cx

This diagram explains the mechanism of the attack where traffic was redirected to dedicated interception servers.

The incident was identified by monitoring discrepancies between expected fingerprints and actual responses from pinned exit nodes. Upon reporting these findings to the Tor Project’s network health team, operators began shutting down affected relays within days. By October 5, most infected servers were taken offline, resulting in a visible dip in total available exit nodes on official metrics. While it remains unclear how the initial breaches occurred—with theories ranging from compromised hosting providers to individual host vulnerabilities—the event highlighted the risks of running public infrastructure without robust hardware keys or strict key-based authentication requirements.

Line chart showing the dip in the count of Tor exit nodes
A graph showing the visible decrease in available Tor exit nodes following the removal of infected relays.kaba.cx

This chart visualizes the dip in total available exit nodes mentioned in the third paragraph.