Threat reportSupply ChainTL-2026-4101
333 Tor Exit Nodes Hijacked to Intercept SSH Logins and Steal Credentials (Ebury 1.8.3)
333 Tor Exit Nodes Hijacked to Intercept SSH Logins and (TL-2026-4101) is a high-severity supply-chain compromise, first published 2026-10-22 and last reviewed 2026-10-23. It has no confirmed attribution, affects Tor Project Tor exit relays (333 relays, ~10% of exit capacity), maps to 16 MITRE ATT&CK techniques (T1021.004, T1027, T1033), and is covered by 9 detection rules and 17 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 16MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 17Indicators of compromise
Key facts for TL-2026-4101
- Threat ID
- TL-2026-4101
- Severity
- HIGH
- Status
- MONITORING
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, government administration, finance, critical-infrastructure
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 17
- Updates
- 2026-10-23 · revalidated 1× · latest source
Malware and tooling in 333 Tor Exit Nodes Hijacked to Intercept SSH Logins and
Malware and tooling: Ebury, Ebury 1.8.3, Tor - S0183, paramiko
How 333 Tor Exit Nodes Hijacked to Intercept SSH Logins and works
Attackers who had compromised the servers behind 333 Tor exit relays (about 10% of ~3,000 exits) redirected SSH traffic on port 22 to 12 interception servers starting 2026-10-02 to capture passwords and deploy Ebury 1.8.3. The Tor network health team flagged the relays BadExit on 2026-10-04 and the infected servers were shut down on 2026-10-05; attribution is unknown.
On Friday 2026-10-02 at 09:35 a coordinated interception campaign began across 333 Tor exit relays, roughly one in ten of the ~3,000 exit relays. Per the researcher account published by kaba on 2026-10-20 (kaba.cx/posts/20261020_Tor/), the attackers had gained access to the underlying servers in August 2026, about two months earlier. The compromised relays forwarded encrypted web traffic normally but redirected SSH connections on TCP port 22 to one of 12 attacker-controlled SSH interception servers, and secondary reporting says the implant also blocked specific ports to force unencrypted mail traffic into the clear where it could be collected.
The interception servers presented a substituted ED25519 host key, so users saw the OpenSSH 'REMOTE HOST IDENTIFICATION HAS CHANGED' warning. Only users who ignored the warning and continued with password authentication exposed credentials. The attackers then connected to the intended server with the captured credentials, observed the commands typed in the session, and opened a second connection to try to infect the target with Ebury. In kaba's honeypot (sshesame) the follow-up sessions used the Python SSH library paramiko, ran commands to check the user ID and sudo availability, and delivered a base64-encoded Perl installer that was decoded and executed. The payload was identified as Ebury 1.8.3, an OpenSSH backdoor and credential stealer for Linux.
Kaba noticed the attack on the morning of 2026-10-02 when an SSH connection over Tor returned a changed-host-key warning, then used the exitmap tool to open SSH connections to a controlled server through each of the ~3,000 exit relays and compare host keys. One interception server key fingerprint reported was SHA256:6baCZCPsl+AfQuujUS81fMEE/C7UeJ+AwjrImqmDB3E (reported in secondary extraction of the primary post; not independently confirmed). The Tor network health team warned operators and flagged the relays BadExit on 2026-10-04, the infected servers were shut down on 2026-10-05, and affected relays were restricted from exit use.
Attribution is unresolved. A breach of a shared hosting provider is theorized but unconfirmed. No CVE is associated; the intrusion vector into the relay hosts is not public. Ebury itself is a long-running Linux malware family first seen in 2009 and attributed by ESET to the Windigo operation; it has historically combined a malicious libkeyutils.so library or patched OpenSSH binaries with credential theft and SSH man-in-the-middle activity, but the primary post does not tie this campaign to a named actor. Caveat: this record relies on the primary post as relayed by several secondary outlets; the 12 interception server IPs and hosting providers were not published in any source retrieved, so no network IOC values are included.
MITRE ATT&CK techniques used in TL-2026-4101
Lateral Movement
T1021.004 Remote Services: SSH
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1556 Modify Authentication Process
Discovery
T1033 System Owner/User Discovery
Credential Access
T1056 Input Capture; T1557 Adversary-in-the-Middle
Execution
T1059.006 Command and Scripting Interpreter: Python
Initial Access
Command and Control
T1090 Proxy; T1090.003 Proxy: Multi-hop Proxy
Persistence
T1554 Compromise Host Software Binary; T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking
Resource Development
T1584 Compromise Infrastructure; T1584.004 Compromise Infrastructure: Server
Affected products and versions in 333 Tor Exit Nodes Hijacked to Intercept SSH Logins and
- Tor Project — Tor exit relays (333 relays, ~10% of exit capacity)
Vulnerable versions: Relays on compromised hosting servers, 2026-10-02 to 2026-10-05
Fixed in: Relays flagged BadExit 2026-10-04; infected servers shut down 2026-10-05 - OpenSSH — OpenSSH clients and servers (password authentication)
Vulnerable versions: Clients that ignored host-key change warnings
Remediation for 333 Tor Exit Nodes Hijacked to Intercept SSH Logins and
Immediate actions
- Treat any SSH password or session sent through a Tor exit between 2026-10-02 and 2026-10-05 as compromised: rotate those credentials and review authentication logs on the target hosts
- Never bypass the 'REMOTE HOST IDENTIFICATION HAS CHANGED' warning; verify the host key out-of-band before connecting
- Hunt target servers for Ebury indicators, including a modified libkeyutils.so and unexpected sshd or ssh library loads
Workarounds
- Use Tor onion services for SSH to avoid exit relays
- Run exitmap-style host-key checks against your own server through exits to detect interception
Longer-term hardening
- Replace SSH password authentication with public-key authentication and disable PasswordAuthentication in sshd_config
- Pin host keys with known_hosts, StrictHostKeyChecking and SSHFP or certificate-based host authentication
- Avoid administering servers over Tor exits; connect to your own onion service or a bastion instead
- Relay operators: audit hosting-provider access and server integrity, and monitor exit policy and routing for unexpected redirects
Weaknesses (CWE) in 333 Tor Exit Nodes Hijacked to Intercept SSH Logins and
Timeline of 333 Tor Exit Nodes Hijacked to Intercept SSH Logins and
- ESET publishes an in-depth analysis of Linux/Ebury, an OpenSSH backdoor and credential stealer later tied to the Windigo operation (background for the malware family named in this campaign)
- Attackers gain access to the servers underlying the Tor exit relays at an unspecified point in August 2026 (day not published; first of month used as placeholder)
- Login from 185.225.226.62 against one relay operator's management server, reported as the initial compromise; Ebury 1.8.3 deployed quietly on relay servers in August.
- Attackers begin editing torrc exit policies on compromised relays (opening port 22 on 342 relays, converting ~24 non-exit relays to exits); changes continue through 2026-10-04.
- Researcher kaba sees an SSH changed-host-key warning over Tor and begins scanning exit relays with exitmap
- At 09:35 the 333 compromised exit relays begin redirecting SSH on port 22 to 12 interception servers and interfering with unencrypted mail traffic
- Directory authorities vote BadExit at 18:00 UTC with consensus inclusion by 21:00 UTC; modified relays peaked at 7.46% of Tor exit capacity (~59 operators, ~3.4 TiB/day on active relays).
- The Tor network health team warns relay operators and flags the affected relays BadExit
- Infected servers are shut down
- Kaba publishes 'How I got over 300 Tor exit nodes removed' on kaba.cx
- Security news outlets, including Cyber Security News, report the campaign
Update history for TL-2026-4101
- 2026-10-23 — Hijacked Tor Exit Relays Redirect SSH Connections to Attacker Servers and Spread Ebury 1.8.3: What changed No severity, exploitability or status change (HIGH / ACTIVE / MONITORING already reflect the facts). The record gains technical depth and scale detail. New indicators (9) Initial-compromise source IP 185.225.226.62, malicious l
Sources cited for 333 Tor Exit Nodes Hijacked to Intercept SSH Logins and
- How I got over 300 Tor exit nodes removed (kaba)
- Hackers Hijack 333 Tor Exit Nodes to Intercept SSH Logins and Steal Credentials
- Hackers Compromise 333 Tor Exit Nodes to Steal SSH Credentials and Deploy Ebury Malware
- 333 Tor Exit Nodes Hijacked by Ebury Malware for SSH Attacks
- Hackers Compromise 333 Tor Exit Nodes to Intercept SSH Connections and Steal Passwords
- Researcher Reports 333 Tor Exit Nodes Hijacking SSH Traffic to Steal Credentials
- An in-depth analysis of Linux/Ebury (ESET)
- Windigo: Ebury update (ESET)
Detection coverage for TL-2026-4101
As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4101 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.