# Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections (Ebury 1.8.3)

> Between Oct 1-5, 2026, attackers changed the torrc exit policy on 333-377 Tor exit relays to allow port 22 and redirect SSH traffic to 12 interception servers that captured passwords from users who accepted unfamiliar host keys. The earliest confirmed compromise was a Quetzalcoatl relay-family management server at Contabo on Aug 28, where the Ebury backdoor v1.8.3 was installed; the Tor Project flagged the relays BadExit/MiddleOnly on Oct 4 and none remained in the consensus by Oct 5.

- **Published:** 2026-10-24T12:23:22Z
- **Last reviewed:** 2026-10-24T12:23:22Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4381
- **ID:** TL-2026-4381
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-02 an independent researcher (kaba) hit a changed SSH host-key warning while connecting through Tor, scanned all ~3,000 exit relays with the exitmap tool and identified 333 exits that redirected SSH (port 22) to 12 interception servers; the Tor directory data later showed 377 relays with policy changes (342 with port 22 enabled, 24 newly converted to exits) across 59 operators. The changes were made by editing torrc exit policies. SecurityOnline reports a first phase in which relays filtered traffic to handle only unencrypted mail protocols before SSH interception began; this detail is from a single secondary source.

The interception servers presented their own SSH host key. Users who accepted a first-time key, or ignored a changed-key warning, entered their password, which was captured; the interceptor relayed the session to the real server, and the attacker then used the stolen password to log in separately, check sudo privileges and deploy a base64-encoded Perl installer for Ebury. Key-based authentication cannot be relayed because the SSH protocol signs a per-connection session identifier, so users authenticating with keys were not exposed to password capture.

The earliest confirmed compromise was the management server of the Quetzalcoatl relay family at Contabo on 2026-08-28. The attacker logged in with operator credentials from 185.225.226.62 and, within about five minutes, escalated to root and installed Ebury 1.8.3; a Switzerland2 VPS was compromised roughly 1.5 hours later with a different attacker SSH key. Root causes documented by the operator (Stefan Zimmer): one password reused for SSH login, sudo and a backup passphrase, stored in plaintext on the Contabo management host and a FranTech VPS, password authentication enabled on an internet-facing management host, and 'offline' relay master keys backed up encrypted with the same password.

Ebury 1.8.3 is delivered as a single setuid library, /usr/lib/x86_64-linux-gnu/libkeyutils.so.1.10.2 (63,368 bytes, not owned by any package), with the libkeyutils.so.1 symlink repointed to it while the packaged library is left untouched so dpkg -V and debsums checks pass. It steals credentials from SSH, sudo and PAM flows, embeds RSA and ED25519 SSH keys for independent remote access, listens on the abstract UNIX socket @event-0YsOG9WSOE, runs a fake process (/sbin/rsyslogd, systemd-udevd or arpd) inside the ssh.service cgroup, hides configuration changes from login/sudo/cron logs and survives reboot. ESET's public v1.8.2 detection did not cover 1.8.3 until Marc-Etienne M. Leveille published an updated detection script on 2026-10-21.

Scope is broader than one operator: 71 of 101 FranTech/BuyVM-hosted relays changed policy versus 13 of 9,054 elsewhere, and 40 relays from 21 operators changed within 5.5 minutes on Oct 1, indicating pre-established access. Possible explanations offered by Leveille: an Ebury-infected host giving lateral access, a compromised hosting-provider management infrastructure, or both; the initial access vector for the wider set is unconfirmed. The actor is unattributed; Ebury is historically tied to financially motivated operators (ESET: ~400,000 servers compromised 2009-2023), but no source attributes this campaign. Peak attacker capacity was 7.46% of Tor exit bandwidth on Oct 4. Tor directory authorities voted BadExit/MiddleOnly on Oct 4 (18:00-21:00 UTC); a scripted restart swept 55 Quetzalcoatl hosts on Oct 5 by an unknown actor; no hijacked relay had returned by Oct 9 and exit count remained ~370 below baseline on Oct 18.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1195 Supply Chain Compromise
- T1021.004 Remote Services: SSH
- T1059 Command and Scripting Interpreter
- T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid
- T1574 Hijack Execution Flow
- T1098.004 Account Manipulation: SSH Authorized Keys
- T1014 Rootkit
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1140 Deobfuscate/Decode Files or Information
- T1557 Adversary-in-the-Middle
- T1556 Modify Authentication Process
- T1552 Unsecured Credentials
- T1584.004 Compromise Infrastructure: Server

## Sources

- [Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections](https://thehackernews.com/2026/10/attackers-hijacked-over-300-tor-exit.html)
- [kaba: Tor exit relay SSH interception analysis](https://kaba.cx/posts/20261020_Tor/)
- [Tor exit nodes hijacked with Ebury malware (SecurityOnline)](https://securityonline.info/tor-exit-nodes-ebury-malware/)
- [Hijacked Tor exit relays used to intercept SSH connections (SC Media)](https://www.scworld.com/brief/hijacked-tor-exit-relays-used-to-intercept-ssh-connections)
- [ESET Research: Ebury botnet alive & growing; 400k Linux servers compromised](https://www.eset.com/us/about/newsroom/press-releases/eset-research-ebury-botnet-alive-growing/)
- [A single operator got 333 infected Tor exit nodes shut down (discussion)](https://zeli.app/story/50166257)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4381