Tech333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email

A researcher reported that unidentified hackers hijacked more than 300 Tor exit nodes, configuring them to favor unencrypted email traffic and route SSH connections through servers they controlled. The attacker used a reused valid password to access a Tor management server and install the Linux backdoor Ebury, then installed it on a second server, Switzerland2, and altered settings on two exit nodes it hosted.

TorcybersecuritySSHemail

AArs Technica★★★☆☆2026-10-22 11:30Original