On October 2, 2026, 333 Tor exit relays — roughly 10% of the network's ~3,000 exit nodes — activated a coordinated attack. The nodes had been compromised two months earlier in August, when unknown actors deployed Ebury 1.8.3, an OpenSSH backdoor and credential stealer, across every one of them. The campaign had two goals: intercept unencrypted mail traffic by restricting which ports the infected exits would serve, and man-in-the-middle SSH connections by redirecting them to 12 dedicated interception servers. The attack was discovered by a single researcher who noticed a host key mismatch during a routine SSH connection over Tor. The standard OpenSSH warning — "REMOTE HOST IDENTIFICATION HAS CHANGED" — flagged the MITM. Anyone who ignored that warning had their password stolen, their session observed in real time, and their destination server infected with Ebury. The attack chain was elegant in its simplicity: steal the credential, mirror the session, propagate the malware. The researcher built a systematic scan using exitmap, a Tor circuit-pinning tool, that tested every exit relay in the network. Server A initiated SSH connections to Server B through each pinned exit. Server B verified whether the connection arrived from the expected exit node or from one of the 12 interception servers. Around a dozen exits served fake SSH fingerprints; over 300 more redirected traffic through the same interception infrastructure without altering fingerprints. The redirection alone was sufficient to confirm infection. Further analysis used sshesame as a honeypot, tricking the MITM into logging into a decoy. This revealed the attackers used paramiko (a Python SSH library) and attempted Ebury installation via a base64-encoded Perl payload executed through sudo. The installation script checked permissions first — a disciplined operational pattern consistent with an experienced group. The Tor Project's network health team, contacted Friday evening, confirmed this was unprecedented: "We've not seen an attack like that before." By Sunday, the affected relays were flagged BadExit and operators began shutdowns. The attackers attempted to restart relays on Monday, but the flags limited them to middle-relay status, neutralizing the exit-based attack. All infected servers were down by Monday evening. The metrics.torproject.org graphs show a visible capacity dip on October 4 that has not recovered. The root cause remains unknown. One theory suggests the hosting provider itself was compromised, but this is unconfirmed. Attribution is similarly uncertain — the use of Ebury and broad data collection patterns point toward a financially motivated crime group, but this is speculation. ESET researcher Marc-Etienne M. Léveillé noted that Ebury has infected an estimated 400,000 servers between 2009 and 2023, suggesting other compromised Tor relays likely remain undiscovered. The structural lesson is stark: Tor's security model assumes relay operators run clean infrastructure, but provides no continuous verification mechanism against supply-chain compromise of the relays themselves. A network that routes roughly 2 million daily users had 10% of its exit capacity silently weaponized for two months before a single SSH fingerprint check caught it. The Tor team responded within 48 hours of notification — commendable speed — but the detection was accidental, not systemic.
