Tor exit nodes hijacked to intercept SSH and email traffic

Hackers hijacked 333 Tor exit nodes to intercept SSH connections and retrieve plaintext email. The campaign, which occurred between October 2 and October 5, involved redirecting SSH traffic through 12 attacker-controlled interceptor servers. Users who ignored SSH host key change warnings risked exposing their passwords.

The attackers also manipulated email traffic by blocking ports used for encrypted email services, such as 25, 465, 587, 993, and 995. This forced services to potentially downgrade to unencrypted connections, allowing the attackers to capture unencrypted messages.

Investigations suggest the breach began in late August when an attacker used a reused password to access a Tor management server. The attackers installed Ebury, a long-known Linux backdoor, and gained administrative control over a server named Switzerland2 to reconfigure exit nodes. It remains unclear how the attackers gained control over all the underlying servers involved.