333 Tor exit nodes hijacked to intercept SSH and email traffic

Hackers hijacked 333 Tor exit nodes by exploiting reused passwords on a management server and installing the Ebury Linux backdoor. The attackers reconfigured nodes to redirect SSH traffic to 12 controlled interceptor servers and blocked encrypted email ports to force unencrypted connections. The campaign, which occurred between October 2 and October 5, targeted users who ignored SSH host key warnings.

Technical details of the hijacking

• Attackers used a valid, reused password to access a Tor management server.
• The Ebury Linux backdoor was installed on compromised servers.
• SSH traffic on Port 22 was redirected to 12 attacker-controlled interceptor servers.
• Exit nodes were configured to block encrypted email ports (25, 465, 587, 993, 995) to encourage unencrypted traffic.
• If users ignored SSH host key change warnings, attackers captured passwords and observed commands.

Why it matters

The incident highlights the risks of password reuse in infrastructure management and the importance of enforcing encrypted-only email protocols and SSH key-based authentication.