333 Tor exit nodes hijacked in SSH, email intercept attack
Original: 333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email
Why This Matters
Shows Tor's exit node infrastructure is a viable target for credential-reuse supply chain attacks.
Unknown attackers hijacked 333 Tor exit nodes from Oct. 2–5, 2026, redirecting SSH traffic to 12 interception servers and blocking encrypted email ports to harvest plaintext messages, a Tor volunteer reported Tuesday.
The attack began in late August when hackers used a reused password to access a Tor management server, then installed Ebury—a Linux backdoor first discovered 12 years ago. From there, they pivoted to a second server called Switzerland2 via SSH using an RSA key that investigators still can't account for in Switzerland2's authorized keys file. Both servers ended up running Ebury.
With that foothold, attackers reconfigured 333 exit relays. One change silently redirected port 22 SSH traffic through 12 attacker-controlled interception servers. Users who dismissed the SSH host key mismatch warning would then unknowingly hand over their passwords. A second change blocked encrypted email ports—25, 465, 587, 993, and 995—while leaving unencrypted email ports open, hoping to force connection downgrades and capture plaintext messages. Whether any downgrade succeeded remains unclear.
Tor volunteer Kaba, who authored Tuesday's post-mortem, personally hit one of the infected exit nodes: "Encrypted web traffic is forwarded as usual, but if you attempt an SSH connection over Port 22, you're unknowingly redirected to one of 12 SSH interception servers. That's exactly what happened to me on Friday morning." How the attackers gained control of all 333 underlying servers beyond the two initially documented remains unsolved.