# 333 Tor Exit Nodes Hijacked to Intercept SSH Logins and Steal Credentials (Ebury 1.8.3)

> Attackers who had compromised the servers behind 333 Tor exit relays (about 10% of ~3,000 exits) redirected SSH traffic on port 22 to 12 interception servers starting 2026-10-02 to capture passwords and deploy Ebury 1.8.3. The Tor network health team flagged the relays BadExit on 2026-10-04 and the infected servers were shut down on 2026-10-05; attribution is unknown.

- **Published:** 2026-10-22T03:26:36Z
- **Last reviewed:** 2026-10-23T15:07:54.881Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4101
- **ID:** TL-2026-4101
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On Friday 2026-10-02 at 09:35 a coordinated interception campaign began across 333 Tor exit relays, roughly one in ten of the ~3,000 exit relays. Per the researcher account published by kaba on 2026-10-20 (kaba.cx/posts/20261020_Tor/), the attackers had gained access to the underlying servers in August 2026, about two months earlier. The compromised relays forwarded encrypted web traffic normally but redirected SSH connections on TCP port 22 to one of 12 attacker-controlled SSH interception servers, and secondary reporting says the implant also blocked specific ports to force unencrypted mail traffic into the clear where it could be collected.

The interception servers presented a substituted ED25519 host key, so users saw the OpenSSH 'REMOTE HOST IDENTIFICATION HAS CHANGED' warning. Only users who ignored the warning and continued with password authentication exposed credentials. The attackers then connected to the intended server with the captured credentials, observed the commands typed in the session, and opened a second connection to try to infect the target with Ebury. In kaba's honeypot (sshesame) the follow-up sessions used the Python SSH library paramiko, ran commands to check the user ID and sudo availability, and delivered a base64-encoded Perl installer that was decoded and executed. The payload was identified as Ebury 1.8.3, an OpenSSH backdoor and credential stealer for Linux.

Kaba noticed the attack on the morning of 2026-10-02 when an SSH connection over Tor returned a changed-host-key warning, then used the exitmap tool to open SSH connections to a controlled server through each of the ~3,000 exit relays and compare host keys. One interception server key fingerprint reported was SHA256:6baCZCPsl+AfQuujUS81fMEE/C7UeJ+AwjrImqmDB3E (reported in secondary extraction of the primary post; not independently confirmed). The Tor network health team warned operators and flagged the relays BadExit on 2026-10-04, the infected servers were shut down on 2026-10-05, and affected relays were restricted from exit use.

Attribution is unresolved. A breach of a shared hosting provider is theorized but unconfirmed. No CVE is associated; the intrusion vector into the relay hosts is not public. Ebury itself is a long-running Linux malware family first seen in 2009 and attributed by ESET to the Windigo operation; it has historically combined a malicious libkeyutils.so library or patched OpenSSH binaries with credential theft and SSH man-in-the-middle activity, but the primary post does not tie this campaign to a named actor. Caveat: this record relies on the primary post as relayed by several secondary outlets; the 12 interception server IPs and hosting providers were not published in any source retrieved, so no network IOC values are included.

## MITRE ATT&CK

- T1584 Compromise Infrastructure
- T1557 Adversary-in-the-Middle
- T1090 Proxy
- T1078 Valid Accounts
- T1021.004 Remote Services: SSH
- T1059.006 Command and Scripting Interpreter: Python
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1033 System Owner/User Discovery
- T1554 Compromise Host Software Binary
- T1584.004 Compromise Infrastructure: Server
- T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking
- T1056 Input Capture
- T1556 Modify Authentication Process
- T1036 Masquerading
- T1090.003 Proxy: Multi-hop Proxy

## Sources

- [How I got over 300 Tor exit nodes removed (kaba)](https://kaba.cx/posts/20261020_Tor/)
- [Hackers Hijack 333 Tor Exit Nodes to Intercept SSH Logins and Steal Credentials](https://cybersecuritynews.com/hackers-hijack-333-tor-exit-nodes/)
- [Hackers Compromise 333 Tor Exit Nodes to Steal SSH Credentials and Deploy Ebury Malware](https://gbhackers.com/hackers-compromise-333-tor-exit-nodes/)
- [333 Tor Exit Nodes Hijacked by Ebury Malware for SSH Attacks](https://securityonline.info/tor-exit-nodes-ebury-malware/)
- [Hackers Compromise 333 Tor Exit Nodes to Intercept SSH Connections and Steal Passwords](https://cyberpress.org/hackers-compromise-333-tor-exit-nodes/)
- [Researcher Reports 333 Tor Exit Nodes Hijacking SSH Traffic to Steal Credentials](https://mallory.ai/stories/01a159b1-f074-7bb1-83a0-bffe8989d2a2)
- [An in-depth analysis of Linux/Ebury (ESET)](https://welivesecurity.com/2014/02/21/an-in-depth-analysis-of-linuxebury)
- [Windigo: Ebury update (ESET)](https://www.welivesecurity.com/2017/10/30/windigo-ebury-update-2/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4101