A security breach affecting 333 Tor exit nodes occurred between October 2 and October 5. Attackers gained unauthorized access to servers to intercept SSH traffic and attempt to capture unencrypted email communications.
The campaign began in late August when an attacker accessed a Tor management server using a reused password. They installed the Ebury Linux backdoor and subsequently compromised a second server, Switzerland2, using an unauthorized RSA key.
The attackers redirected SSH traffic to 12 interceptor servers. Users who ignored host key change warnings and entered their credentials had their passwords stolen, their commands monitored, and their servers infected with Ebury.
The compromised exit nodes were configured to block encrypted email ports, including 25, 465, 587, 993, and 995, while allowing unencrypted traffic. It remains unconfirmed if any attempts to downgrade email connections to plaintext were successful.
Tor volunteers identified the breach by polling approximately 3,000 exit nodes and using a honeypot to observe the infection process. The method used to compromise the majority of the underlying servers remains unknown.
