--- title: How I got over 300 Tor exit nodes removed | daily.dev description: A coordinated attack compromised 333 Tor exit nodes, about 10% of the network's roughly 3000 exit relays, to intercept SSH connections and steal unencrypted... canonical: https://daily.dev/posts/how-i-got-over-300-tor-exit-nodes-removed-luas3vpcw twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How I got over 300 Tor exit nodes removed | daily.dev og:description: A coordinated attack compromised 333 Tor exit nodes, about 10% of the network's roughly 3000 exit relays, to intercept SSH connections and steal unencrypted... og:url: https://daily.dev/posts/how-i-got-over-300-tor-exit-nodes-removed-luas3vpcw og:image: https://api.daily.dev/og/posts/LuaS3VpCw.png og:image:alt: How I got over 300 Tor exit nodes removed og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How I got over 300 Tor exit nodes removed **[Hacker News](https://daily.dev/sources/hn)** · 5 min read · 0 upvotes · 0 comments ## Summary A coordinated attack compromised 333 Tor exit nodes, about 10% of the network's roughly 3000 exit relays, to intercept SSH connections and steal unencrypted mail traffic. Attackers deployed the Ebury OpenSSH backdoor two months earlier and redirected SSH logins through 12 interception servers to steal passwords and infect servers. The author built a script using exitmap to test all ~3000 exit relays, finding about a dozen serving fake fingerprints and over 300 redirecting through the same interception servers. The Tor network health team flagged the relays as BadExit starting October 4, and all infected servers were shut down by October 5. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the Ebury malware used in the recent Tor exit node SSH interception attack? Ebury is an OpenSSH backdoor and credential stealer targeting Linux systems. In this campaign attackers deployed Ebury version 1.8.3 after gaining access to Tor relay servers two months before launching the attack. Marc-Etienne M. Léveillé noted roughly 400,000 servers had been infected with Ebury between 2009 and 2023, suggesting more compromised Tor relays likely exist. _Anyone hardening SSH-exposed infrastructure can track emerging backdoor campaigns like this one on daily.dev._ ### How can I tell if a Tor exit node is intercepting my SSH connection? An SSH connection routed through a compromised exit node gets redirected to an attacker-controlled interception server, triggering an SSH host key mismatch warning because the fingerprint no longer matches the real server. If a user ignores that warning and logs in anyway, the attacker steals the password, observes commands via a MITM session, and infects the destination server with Ebury. _Developers relying on Tor for SSH access can follow writeups like this to spot MITM warning signs on daily.dev._ ### How did researchers detect which Tor exit nodes were compromised in the SSH interception attack? A researcher used the exitmap tool to pin each of roughly 3,000 Tor exit relays and open SSH connections between two of their own servers, checking the received fingerprint and the originating IP on each end. About a dozen relays served a fake fingerprint, and over 300 others redirected traffic through the same 12 interception servers without altering the fingerprint, confirming infection. _Security practitioners building similar detection tooling can follow this methodology via daily.dev._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 67 comments across hackernews (as of 2026-10-20). **TL;DR:** The discussion largely praises the author's detective work exposing the compromised exit nodes, while branching into tangential but lively debates about why anyone would SSH over Tor, the legal/practical risks of running exit nodes, and whether cloud VM memory isolation (like AWS IOMMU/SEV) can really be trusted. **Sentiment:** 30% positive · 45% mixed · 25% skeptical **The case for** - The researcher's methodology (using exitmap to scan all ~3000 exits) was seen as a useful, well-executed piece of detective work. - Several commenters offered legitimate use cases for SSH over Tor, like anonymity, hidden-service administration, or bypassing restrictive firewalls. - Some noted the attack was actually poorly designed since SSH's MITM warning made it easy to detect and trace, enabling a quick shutdown. **The pushback** - Running a Tor exit node (or even a relay) carries real legal risk, with examples cited of operators being raided or falsely accused of crimes. - Skepticism that cloud providers' memory-protection claims (e.g. AWS IOMMU, confidential computing) genuinely protect guest VM data from a compromised or snooping host. - Some suspect a large fraction of the ~3000 exit nodes are run by intelligence agencies or bad actors logging traffic rather than genuine volunteers. **By community** - hackernews (mixed): Commenters thank the author for the writeup and dig into technical details, but the thread splits into separate heated side-debates about Tor use cases and VM security trust. **Hottest debate:** Whether hardware-based VM memory protections (like AWS's IOMMU or SEV) can actually be trusted against a compromised or malicious cloud host. **Open questions** - How exactly did the attackers initially gain access to the compromised exit node servers? - Whether the hosting provider FranTech/BuyVM itself was compromised, since most infected relays clustered there. - What proportion of the ~3000 Tor exit nodes are run by intelligence agencies, researchers, or bad actors versus genuine volunteers. **Highlights** > Author here :) TLDR: on Oct 2, 333 exits (~10% of Tor exits) started redirecting port 22 to 12 interception servers running a paramiko-based MITM that stole passwords and tried to drop Ebury on the target. > — [kabakabakaba on hackernews · 3 comments](https://news.ycombinator.com/item?id=50166258) > In my scan on October 2, 26 of the 27 compromised servers outside the Quetzalcoatl relay family (most hosting multiple exits) were at FranTech/BuyVM. It's been discussed on the mailing list: https://lists.torproject.org/mailman3/hyperkitty/list/tor-re... That doesnt prove FranTech itself was compromised, but its a strong cluster. AFAIK nobody has contacted them yet, if no one does, I plan to give them a heads up in the coming days. > — [kabakabakaba on hackernews · 1 comments](https://news.ycombinator.com/item?id=50167314) > The attack on SSH seems rather poorly conceived. Not only was it detected immediately thanks to SSH printing that huge banner on MITM attacks, but it allowed the admins to easily trace every infected node and respond quickly to shut the whole operation down. Had they stuck to email they would still be running today. > — [jandrese on hackernews](https://news.ycombinator.com/item?id=50169815) > Yet less than 20% of the 80+ major vulnerabilities in confidential computing have been found by cloud companies, with the majority being found by universities and independent researchers. It's not actually in their interest to look too closely. They know they are selling snake oil, and they do not care if it works. The only function of the technology, as far as they are concerned, is to be something they can market to customers who are scared at running on public cloud, and either they never intend to exploit it, in which case it doesn't matter if it doesn't work, or they do, in which case they don't want the vulnerabilities to be found and fixed. Either way, there is no upside to them for going spelunking. > — [Tuna-Fish on hackernews · 1 comments](https://news.ycombinator.com/item?id=50172181) > In many countries, running an exit node is a very fast way to have cop knocking at your door and seizing all your stuff. To run a tor exit node, you either have to try your best to stay anonymous, preferably be based in a country who don't care at all about cyber crime, and run them on a dodgy hosting provider who dgaf. Or you have to create a legal entity, either a non-profit or a company, depending on the country register as a hosting provider (so that you are not consider legally responsible for what comes out of your server if you abide by some rules), and you will still have to respond pretty fast to any police inquiry. If anything, it's a miracle that there is 3000 of them. Although you can safely assume that a good portion of them (if not the majority) are operated by state intelligence services, cybersecurity companies and bad actor, who will log everything that pass through their node (and might be able to decrypt them one day). > — [maeln on hackernews · 2 comments](https://news.ycombinator.com/item?id=50169525) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=50166257) · 273 points · 67 comments ## Similar posts on daily.dev - [Trojaned OpenSSH](https://daily.dev/posts/trojaned-openssh-1b563evx6) · Lobsters · 0 upvotes · 0 comments - [SSHStalker botnet brute-forces its way onto 7,000 Linux machines](https://daily.dev/posts/sshstalker-botnet-brute-forces-its-way-onto-7-000-linux-machines-d1nrvsgyf) · CSO Online · 14 upvotes · 0 comments - [Infosec researchers mull curious case of Telnet ancient flaw](https://daily.dev/posts/infosec-researchers-mull-curious-case-of-telnet-ancient-flaw-kzhismy5k) · The Register · 0 upvotes · 0 comments - [A Botnet Accidentally Destroyed I2P \(The Full Story\)](https://daily.dev/posts/a-botnet-accidentally-destroyed-i2p-the-full-story--bhgnwhgtj) · Hacker News · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ssh](https://daily.dev/tags/ssh) [View this post on daily.dev](https://daily.dev/posts/how-i-got-over-300-tor-exit-nodes-removed-luas3vpcw) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How I got over 300 Tor exit nodes removed","url":"https://daily.dev/posts/how-i-got-over-300-tor-exit-nodes-removed-luas3vpcw","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-i-got-over-300-tor-exit-nodes-removed-luas3vpcw"},"datePublished":"2026-10-20T15:23:55.037Z","dateModified":"2026-10-20T21:35:55.831Z","description":"A coordinated attack compromised 333 Tor exit nodes, about 10% of the network's roughly 3000 exit relays, to intercept SSH connections and steal unencrypted...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e9a93d27cc98715a6477098a1950b7c7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e9a93d27cc98715a6477098a1950b7c7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-i-got-over-300-tor-exit-nodes-removed-luas3vpcw","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ssh","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"How I got over 300 Tor exit nodes removed"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-i-got-over-300-tor-exit-nodes-removed-luas3vpcw#faq","mainEntity":[{"@type":"Question","name":"What is the Ebury malware used in the recent Tor exit node SSH interception attack?","acceptedAnswer":{"@type":"Answer","text":"Ebury is an OpenSSH backdoor and credential stealer targeting Linux systems. In this campaign attackers deployed Ebury version 1.8.3 after gaining access to Tor relay servers two months before launching the attack. Marc-Etienne M. Léveillé noted roughly 400,000 servers had been infected with Ebury between 2009 and 2023, suggesting more compromised Tor relays likely exist. Anyone hardening SSH-exposed infrastructure can track emerging backdoor campaigns like this one on daily.dev."}},{"@type":"Question","name":"How can I tell if a Tor exit node is intercepting my SSH connection?","acceptedAnswer":{"@type":"Answer","text":"An SSH connection routed through a compromised exit node gets redirected to an attacker-controlled interception server, triggering an SSH host key mismatch warning because the fingerprint no longer matches the real server. If a user ignores that warning and logs in anyway, the attacker steals the password, observes commands via a MITM session, and infects the destination server with Ebury. Developers relying on Tor for SSH access can follow writeups like this to spot MITM warning signs on daily.dev."}},{"@type":"Question","name":"How did researchers detect which Tor exit nodes were compromised in the SSH interception attack?","acceptedAnswer":{"@type":"Answer","text":"A researcher used the exitmap tool to pin each of roughly 3,000 Tor exit relays and open SSH connections between two of their own servers, checking the received fingerprint and the originating IP on each end. About a dozen relays served a fake fingerprint, and over 300 others redirected traffic through the same 12 interception servers without altering the fingerprint, confirming infection. Security practitioners building similar detection tooling can follow this methodology via daily.dev."}}]} ```