← Wednesday, October 21, 2026SecurityDeep dive

Attackers compromised 333 Tor exit nodes to intercept SSH connections

kaba.cx 4 min read Editor score 8/10

Attackers installed an OpenSSH backdoor on 333 Tor exit nodes and redirected SSH connections for interception after gaining access two months earlier. The account offers concrete lessons about relay trust, credential theft and incident response.

What

• Attackers compromised 333 Tor exit nodes and used them to intercept SSH connections.

How

• The nodes redirected SSH traffic to 12 interception servers, where attackers could steal passwords, observe commands and infect servers with Ebury.

Why it matters

• SSH host-key warnings and the trust placed in exit relays matter when designing secure remote-access systems.

Read on kaba.cx → Hacker News · 88 commentsLobsters · 1 comments

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.