Researcher takes down 333 rogue Tor exit nodes
Original: How I got over 300 Tor exit nodes removed
Why This Matters
A single coordinated compromise of 10% of Tor's exit relays is a rare, large-scale infrastructure attack.
On Oct 2, 2026, 333 compromised Tor exit nodes—roughly 10% of all exit relays—launched coordinated SSH man-in-the-middle attacks. A researcher identified them within days, triggering a full takedown by Oct 5.
The attack began at 09:35am on Friday, October 2, when 333 infected Tor exit nodes started intercepting SSH connections and harvesting unencrypted mail traffic. Attackers had quietly planted the Ebury 1.8.3 OpenSSH backdoor on the servers two months earlier, in August. With 333 nodes out of roughly 3,000 total exit relays, they controlled about 10% of Tor's exit capacity.
The operation had two goals: vacuum up unencrypted mail traffic by selectively blocking ports, and run SSH man-in-the-middle attacks on Port 22. Victims connecting over an infected exit node were silently redirected to one of 12 SSH interception servers. If users dismissed the standard host-key-changed warning and logged in anyway, attackers stole their password, monitored every command in real time, then used a second connection to infect the victim's server with Ebury.
The blog's author caught the attack firsthand when their own SSH session triggered the warning. Using the exitmap tool, they built a script that pinned each exit node and tested SSH fingerprints between two controlled servers, letting them confirm which nodes were redirecting traffic. They brought findings to the Tor Project's network health team Friday evening. By Sunday, Oct 4, the team had notified operators and flagged all 333 nodes as BadExit. Attackers restarted some relays Monday, but the BadExit flag relegated them to middle-relay status only. All infected servers were offline by October 5.
Metrics.torproject.org shows a visible dip in exit capacity starting October 4 that had not recovered at time of writing.