--- title: 333 Tor exit nodes hijacked to intercept SSH traffic and... description: Attackers hijacked 333 Tor exit nodes to intercept SSH traffic and try to capture plaintext email. A reused password gave the attacker access to a Tor... canonical: https://daily.dev/posts/333-tor-exit-nodes-hijacked-to-intercept-ssh-traffic-and-retrieve-plaintext-email-epbp2y38c twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: 333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email | daily.dev og:description: Attackers hijacked 333 Tor exit nodes to intercept SSH traffic and try to capture plaintext email. A reused password gave the attacker access to a Tor... og:url: https://daily.dev/posts/333-tor-exit-nodes-hijacked-to-intercept-ssh-traffic-and-retrieve-plaintext-email-epbp2y38c og:image: https://api.daily.dev/og/posts/EpBp2Y38C.png og:image:alt: 333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # 333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email **[Ars Technica](https://daily.dev/sources/arstechnica)** · 2 min read · 0 upvotes · 0 comments ## Summary Attackers hijacked 333 Tor exit nodes to intercept SSH traffic and try to capture plaintext email. A reused password gave the attacker access to a Tor management server, where they installed the Ebury Linux backdoor, a tool discovered 12 years ago. They then connected via SSH to a second server, Switzerland2, and reconfigured two of its exit nodes. One change redirected SSH connections through 12 attacker-controlled interceptor servers, prompting SSH host key warnings. Another change blocked encrypted email ports (25, 465, 587, 993, 995) while leaving unencrypted email ports open, which would let the attackers obtain unencrypted messages if email services downgraded connections. The hijacking ran from October 2 to October 5. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How many Tor exit nodes were compromised in the recent SSH interception attack? 333 Tor exit relays were involved in the SSH and email interception campaign. The attack ran from October 2 to October 5, redirecting SSH traffic through 12 attacker-controlled interceptor servers and blocking encrypted email ports (25, 465, 587, 993, 995) while leaving unencrypted email ports open. _daily.dev surfaces security writeups like this for anyone running services over Tor or SSH._ ### How did attackers gain initial access to the compromised Tor relay servers? A reused password gave the attacker access to a Tor management server, where they installed Ebury, a Linux backdoor first discovered 12 years ago. From there they connected via SSH to a second server, Switzerland2, using an RSA key investigators could not find among its authorized keys, then installed Ebury there too and reconfigured its exit nodes. _Track incident details like this on daily.dev before deciding how to harden your own SSH access controls._ ### What happens if my SSH connection gets routed through a malicious Tor exit node? You would be unknowingly redirected to an attacker-controlled SSH interception server instead of your intended destination. The connection would trigger a warning that the SSH host key had changed; ignoring that warning and entering your password would hand it directly to the attacker. _Developers relying on Tor for SSH access follow incidents like this one via daily.dev._ ## Similar posts on daily.dev - [How I got over 300 Tor exit nodes removed](https://daily.dev/posts/how-i-got-over-300-tor-exit-nodes-removed-luas3vpcw) · Hacker News · 0 upvotes · 0 comments - [Trojaned OpenSSH](https://daily.dev/posts/trojaned-openssh-1b563evx6) · Lobsters · 0 upvotes · 0 comments - [SSHStalker botnet brute-forces its way onto 7,000 Linux machines](https://daily.dev/posts/sshstalker-botnet-brute-forces-its-way-onto-7-000-linux-machines-d1nrvsgyf) · CSO Online · 14 upvotes · 0 comments - [Chinese hackers hijack auth flow, spy on isolated network for a decade](https://daily.dev/posts/chinese-hackers-hijack-auth-flow-spy-on-isolated-network-for-a-decade-yeupuqtg0) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#ssh](https://daily.dev/tags/ssh) [View this post on daily.dev](https://daily.dev/posts/333-tor-exit-nodes-hijacked-to-intercept-ssh-traffic-and-retrieve-plaintext-email-epbp2y38c) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email","url":"https://daily.dev/posts/333-tor-exit-nodes-hijacked-to-intercept-ssh-traffic-and-retrieve-plaintext-email-epbp2y38c","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/333-tor-exit-nodes-hijacked-to-intercept-ssh-traffic-and-retrieve-plaintext-email-epbp2y38c"},"datePublished":"2026-10-22T11:43:55.720Z","dateModified":"2026-10-22T11:44:29.502Z","description":"Attackers hijacked 333 Tor exit nodes to intercept SSH traffic and try to capture plaintext email. A reused password gave the attacker access to a Tor...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/250bd8ea596e236502a4a2bc756bc6e9?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/250bd8ea596e236502a4a2bc756bc6e9?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Ars Technica","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Ars Technica","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/80883e0e48a34b5ebcf93777016cb3fe","url":"https://daily.dev/sources/arstechnica"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/333-tor-exit-nodes-hijacked-to-intercept-ssh-traffic-and-retrieve-plaintext-email-epbp2y38c","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,ssh","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Ars Technica","item":"https://daily.dev/sources/arstechnica"},{"@type":"ListItem","position":3,"name":"333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/333-tor-exit-nodes-hijacked-to-intercept-ssh-traffic-and-retrieve-plaintext-email-epbp2y38c#faq","mainEntity":[{"@type":"Question","name":"How many Tor exit nodes were compromised in the recent SSH interception attack?","acceptedAnswer":{"@type":"Answer","text":"333 Tor exit relays were involved in the SSH and email interception campaign. The attack ran from October 2 to October 5, redirecting SSH traffic through 12 attacker-controlled interceptor servers and blocking encrypted email ports (25, 465, 587, 993, 995) while leaving unencrypted email ports open. daily.dev surfaces security writeups like this for anyone running services over Tor or SSH."}},{"@type":"Question","name":"How did attackers gain initial access to the compromised Tor relay servers?","acceptedAnswer":{"@type":"Answer","text":"A reused password gave the attacker access to a Tor management server, where they installed Ebury, a Linux backdoor first discovered 12 years ago. From there they connected via SSH to a second server, Switzerland2, using an RSA key investigators could not find among its authorized keys, then installed Ebury there too and reconfigured its exit nodes. Track incident details like this on daily.dev before deciding how to harden your own SSH access controls."}},{"@type":"Question","name":"What happens if my SSH connection gets routed through a malicious Tor exit node?","acceptedAnswer":{"@type":"Answer","text":"You would be unknowingly redirected to an attacker-controlled SSH interception server instead of your intended destination. The connection would trigger a warning that the SSH host key had changed; ignoring that warning and entering your password would hand it directly to the attacker. Developers relying on Tor for SSH access follow incidents like this one via daily.dev."}}]} ```