@lists.torproject.org/thread/QHRD6YOX6RZRDR7NCHNDO7GLCEA6VFM6/" rel="nofollow noopener noreferrer" target="_blank">according to Tor volunteers, the attacker used a valid password that had been reused to gain access to a Tor management server. The attacker then installed Ebury, a backdoor written for Linux that was discovered 12 years ago.

Mysteries remain

Then the attacker connected from the management server to a second Tor server, called Switzerland2, through SSH, using an RSA key that, for unknown reasons, investigators couldn’t find among Switzerland2’s authorized keys. With administrative control of Switzerland2, the attackers installed Ebury there as well. Finally, the attacker reconfigured settings on two exit nodes that Switzerland2 hosted.

Read full article

Comments

28:T434,{"@context":"https://schema.org","@type":"NewsArticle","@id":"https://nvdium.com/en/articles/922034132#article","url":"https://nvdium.com/en/articles/922034132","headline":"333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email","description":"For 3 days this month, 333 exit nodes were hacked in hopes of stealing sensitive data.","datePublished":"2026-10-22T12:00:43.903Z","dateModified":"2026-10-22T12:00:43.904Z","mainEntityOfPage":"https://nvdium.com/en/articles/922034132","isAccessibleForFree":true,"inLanguage":"en","isPartOf":{"@id":"https://nvdium.com/#website"},"speakable":{"@type":"SpeakableSpecifi