Hackers compromised over 300 Tor exit nodes by exploiting a reused password on a Tor management server and deploying the decade-old Ebury backdoor. The attackers reconfigured the nodes to intercept SSH credentials and force email connections to downgrade to unencrypted protocols, enabling credential and message theft.
Background
The Tor network relies on a distributed system of volunteer-operated exit nodes to provide anonymous internet access. Ebury is a well-known Linux rootkit first discovered in 2014 that compromises SSH daemons to steal credentials.
- Source
- Ars Technica
- Published
- Oct 22, 2026 at 07:30 PM
- Score
- 7.0 / 10