# 333 Tor exit nodes hijacked to intercept SSH and email traffic

> **Key takeaway:** Attackers compromised over 300 Tor exit nodes to redirect SSH connections and downgrade email encryption to steal credentials and plaintext data.

**Published:** 2026-10-22T11:30:33+00:00 
**Source:** Ars Technica 
**Category:** foss-apps 
**Canonical URL:** https://fosswire.org/news/333-tor-exit-nodes-hijacked-to-intercept-ssh-and-email-traff.html 

## Summary
Hackers hijacked 333 Tor exit nodes by exploiting reused passwords on a management server and installing the Ebury Linux backdoor. The attackers reconfigured nodes to redirect SSH traffic to 12 controlled interceptor servers and blocked encrypted email ports to force unencrypted connections. The campaign, which occurred between October 2 and October 5, targeted users who ignored SSH host key warnings.

## Technical details of the hijacking
- Attackers used a valid, reused password to access a Tor management server.
- The **Ebury** Linux backdoor was installed on compromised servers.
- SSH traffic on **Port 22** was redirected to 12 attacker-controlled interceptor servers.
- Exit nodes were configured to block encrypted email ports (**25, 465, 587, 993, 995**) to encourage unencrypted traffic.
- If users ignored SSH host key change warnings, attackers captured passwords and observed commands.

## Why it matters
The incident highlights the risks of password reuse in infrastructure management and the importance of enforcing encrypted-only email protocols and SSH key-based authentication.