333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email

Ars Technica · 2026-10-22 · Auto-collected and curated by AiEmy Cloud (AiEmy Cloud StAck)

Keywords: AiEmy Cloud,AiEmy Cloud StAck,Internet,internet,SaaS,startup,333,Tor,exit,nodes,hijacked,to

AI engine keywords: AiEmy Cloud,AiEmy Cloud StAck,Internet,Tor,exit,nodes,hijacked,What is 333 Tor exit nodes hijacked to intercept SSH…,How does 333 Tor exit nodes hijacked to intercept SSH… work

Internet Pricing Internet Cost Internet Buy

AI Summary

[Topic] 333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext emai
[Type] Internet Industry News
[Key points]
1. For 3 days this month, 333 exit nodes were hacked in hopes of stealing sensitive data.
[Industries] Internet
[Source] Ars Technica (auto-collected by AiEmy Cloud / AiEmy Cloud StAck)

For 3 days this month, 333 exit nodes were hacked in hopes of stealing sensitive data.

Unknown hackers hijacked more than 300 Tor exit nodes and reconfigured them to favor unencrypted email traffic and redirect SSH connections through servers they controlled, a researcher reported Tuesday.

The hijacking began in late August, when, according to Tor volunteers, the attacker used a valid password that had been reused to gain access to a Tor management server. The attacker then installed Ebury, a backdoor written for Linux that was discovered 12 years ago.

Mysteries remain

Then the attacker connected from the management server to a second Tor server, called Switzerland2, through SSH, using an RSA key that, for unknown reasons, investigators couldn’t find among Switzerland2’s authorized keys. With administrative control of Switzerland2, the attackers installed Ebury there as well. Finally, the attacker reconfigured settings on two exit nodes that Switzerland2 hosted.

Read full article

Comments

Frequently asked questions

What is "333 Tor exit nodes hijacked to intercept SSH traffic and ret"?

For 3 days this month, 333 exit nodes were hacked in hopes of stealing sensitive data.. AiEmy Cloud (AiEmy Cloud StAck) tracks and curates updates in this space.

How do Internet teams choose cloud services?

Match scale and compliance needs: transparent billing, fast provisioning, SLA and support. AiEmy Cloud offers cloud services and more, provisioned in minutes and scalable on demand.

AiEmy Cloud support for the Internet sector?

Cloud servers, domains, enterprise email, object storage, CDN and SSL — plus 7×24 support, tickets and documentation across provisioning, DNS and migration.

More industry news in the Industry News section.