Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email

For three days in early October, attackers seized control of 333 Tor exit relays and reconfigured them to intercept SSH sessions and force email connections into cleartext. The breach began after an attacker reused a valid password to access a Tor management server, installed the decade-old Ebury Linux backdoor, then used that server to SSH into a second node called Switzerland2 with an RSA key that investigators cannot reconcile with authorized keys. With control of Switzerland2 the attackers pushed configuration changes to hosted exit relays that redirected SSH traffic to 12 interception servers; users who ignored SSH host-key warnings had their passwords and keystrokes captured, and target servers were subsequently infected with Ebury. The operators also blocked several ports associated with encrypted mail (listed as 25, 465, 587, 993, 995) while leaving cleartext mail ports open, attempting to downgrade or harvest unencrypted messages. The active hijacking ran from October 2-5.

A Tor volunteer probed all ~3,000 exits with a fingerprint test and deployed a honeypot that observed interception and Ebury installation attempts, but many mysteries remain: how the attackers commandeered so many servers, why Switzerland2 accepted an unexplained RSA key, and who stands behind the campaign. The use of Ebury and broad collection of unencrypted data points toward financial motivation. Recommended defenses are concrete: enforce encrypted email and disable acceptance of plaintext ports, disable SSH password authentication and rely on keys, and adopt layered (in-depth) defenses to limit damage from mass compromises.