Massive Tor Relay Hack Redirects SSH and Unencrypted Email Through Attacker Servers

Unknown adversaries compromised more than 300 Tor exit relays, reconfiguring them to favor unencrypted email traffic and to reroute SSH connections through servers under their control, according to a researcher’s report released on Tuesday.

The intrusion began in late August when the attacker leveraged a reused credential to gain access to a Tor management server. Using this foothold, the threat actor deployed Ebury, a Linux‑based backdoor first identified twelve years earlier. The attacker then established a connection from the compromised management server to a second Tor node, Switzerland2, via SSH, employing an RSA key that was not listed among Switzerland2’s authorized keys. With administrative control of Switzerland2 secured, the intruders installed Ebury on that server as well and subsequently altered the configuration of two exit relays hosted by Switzerland2.

Mysteries remain

The operation ultimately involved 333 exit relays used to intercept SSH sessions and capture plaintext email messages. While investigators have confirmed the initial compromises and the subsequent reconfiguration steps, the precise method by which the attackers extended their control to all affected servers remains unclear. One set of modifications redirected SSH traffic that passed through Tor to one of twelve attacker‑controlled interception servers, prompting users who ignored change‑warning prompts to disclose their SSH credentials. A second set of changes disabled ports 25, 465, 587, 993, and 995—commonly used for encrypted email—while preserving the ability to receive unencrypted mail, giving the attackers a pathway to harvest unencrypted communications. It is uncertain whether any of these email downgrade attempts were successful. The entire hijacking took place between October 2 and October 5.

Tor volunteers previously disclosed the initial breach of the management server and Switzerland2, as well as the attempted interception of unencrypted email. Tuesday’s detailed report added new insights, including the total number of compromised exit nodes and the specific technique used to reroute SSH traffic.

“If you happen to get a circuit that exits over one of those 333 infected exit nodes, you won’t notice anything at first,” wrote Kaba, the Tor volunteer who authored the post. “Encrypted web traffic is forwarded as usual, but if you attempt an SSH connection over Port 22, you’re unknowingly redirected to one of 12 SSH interception servers. That’s exactly what happened to me on Friday morning.” Kaba then received the following warning:

Source link