# 333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email

https://mins.news/en/item/111025

- Ars Technica, 2026-10-22 11:30 UTC
- Tech
- Original: https://arstechnica.com/information-technology/2026/10/300-tor-exit-nodes-hijacked-to-intercept-ssh-traffic-and-retrieve-plaintext-email/

> A researcher reported that unidentified hackers hijacked more than 300 Tor exit nodes, configuring them to favor unencrypted email traffic and route SSH connections through servers they controlled. The attacker used a reused valid password to access a Tor management server and install the Linux backdoor Ebury, then installed it on a second server, Switzerland2, and altered settings on two exit nodes it hosted.