Unknown attackers hijacked more than 300 Tor exit nodes during a three-day period in early October, attempting to intercept unencrypted communications and steal credentials from users routing traffic through the compromised infrastructure.
The campaign began in late August when attackers gained access to a Tor management server using a reused valid password. They then installed Ebury, a Linux backdoor malware discovered over a decade ago, and used that foothold to compromise a secondary server called Switzerland2. From there, the attackers reconfigured 333 exit relay nodes to execute their interception strategy. One modification redirected SSH traffic to 12 attacker-controlled servers, where users who ignored security warnings about changed host keys would have their SSH passwords captured. A second set of changes blocked ports commonly used for encrypted email transmission while allowing unencrypted email ports to remain open, potentially enabling credential harvesting if email services downgraded to unencrypted connections.
The attack was discovered when a Tor volunteer received a host key identification warning while attempting to establish an SSH connection. Upon investigation, the volunteer determined that users ignoring the warning faced three threats: password theft, command observation by attackers, and infection with the Ebury malware. The volunteer created detection tools by scripting tests across Tor’s approximately 3,000 exit nodes and established a honeypot to observe the interception attempts.
Several questions about the intrusion remain unanswered, including how attackers gained control of all the underlying servers and the identity of the threat actors. Investigators theorize the attackers may have compromised a hosting company or represent a financially motivated criminal group based on their tactics and tool selection. Security researchers have recommended that users implement multiple defensive measures, including configuring email systems to accept only encrypted connections and disabling password-based SSH authentication in favor of key-based methods.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI