---
title: "Tor Exit Nodes Hijacked by Hackers"
url: https://noti.group/tor-exit-nodes-hijacked-by-hackers/
language: en
publisher: "Noti Group"
section: "Technology"
published: 2026-10-22T11:30:33.000Z
updated: 2026-10-23T01:48:07.235Z
id: e1d09655-b071-4278-937c-8a805ea40e0a
source: "Ars Technica https://arstechnica.com/information-technology/2026/10/300-tor-exit-nodes-hijacked-to-intercept-ssh-traffic-and-retrieve-plaintext-email/"
attribution: "Link to https://noti.group/tor-exit-nodes-hijacked-by-hackers/ and name Noti Group when you quote or summarize this story."
---

# Tor Exit Nodes Hijacked by Hackers

Hackers have taken control of over 300 Tor exit nodes, using them to intercept and redirect secure shell (SSH) connections and unencrypted email traffic. The hijacking began in late August, when an attacker gained access to a Tor management server by reusing a valid password.

The attacker then installed Ebury, a Linux backdoor discovered 12 years ago, on the management server. This allowed them to gain administrative control over another Tor server, called Switzerland2, which they connected to using SSH with a mysterious RSA key that wasn't authorized on the server.

From Switzerland2, the attackers reconfigured settings on two exit nodes hosted by the server. These modifications had far-reaching consequences, ultimately affecting 333 exit relays involved in the campaign. The exact method of gaining control over these underlying servers remains unclear.

The attackers then made a series of changes to the compromised exit nodes. One set redirected SSH traffic traversing Tor through one of 12 attacker-controlled interceptor servers. This meant that users who ignored warnings about an unfamiliar host key would enter their SSH passwords unknowingly, exposing them to potential eavesdropping.

As a result of these modifications, users accessing certain email services via Tor may have been sending unencrypted emails. Meanwhile, SSH connections were being redirected through the attackers' controlled servers, leaving users vulnerable to interception and data theft.

The attackers' control extended beyond redirecting SSH connections. They also manipulated the Tor exit nodes to block encrypted email ports, including those used for SMTP (25), secure SMTP over SSL/TLS (465 and 587), IMAP (993), and POP3 (995). This effectively barred users from sending or receiving encrypted emails through these channels.

However, if recipients' email services downgraded their connections to unencrypted protocols, the attackers exploited this vulnerability to intercept the plaintext messages. It is unclear whether any such downgrade attempts were successful in yielding usable data for the attackers.

According to Tor volunteers, the hijacking of exit nodes was part of a larger scheme to compromise users' sensitive information. The attackers had gained control over 333 Tor exit nodes from October 2 to October 5, using them to redirect SSH traffic through their own servers.

The compromised exit nodes allowed attackers to intercept unencrypted email messages when recipients' services downgraded connections. This tactic would have gone unnoticed by users who unknowingly established circuits with the infected nodes.

A warning message was triggered in some users' SSH clients, alerting them to a potential man-in-the-middle attack.

The message indicated that someone might be intercepting their communication and even altering the host key of the remote server. The ED25519 key sent by the attacker had a specific SHA256 fingerprint: 6baCZCPsl+AfQuujUS81fMEE/C7UeJ+AwjrImqmDB3E.

Those who ignored the warning were vulnerable to further exploitation, as the attackers could steal their SSH password and monitor all typed commands. The attackers also opened a second connection to install Ebury malware on the server.

To investigate this campaign, a Tor volunteer created a script that scanned about 3,000 exit nodes for any anomalies in SSH connections. The test server checked whether these connections came from trusted exit nodes or one of several servers used by the attacker.

Further investigation was conducted using a honeypot to observe the interception software's behavior when attempting to log in and install Ebury malware on compromised servers.

Switzerland2's behavior raises questions about its security protocols. Despite a lack of evidence suggesting it was an authorized SSH certificate, the server still accepted an RSA key. This anomaly suggests that Switzerland2 may have had some vulnerabilities in place.

The incident highlights the importance of robust defense measures in preventing data breaches during large-scale hacks like this one. Experts stress that configuring email accounts to only accept encrypted traffic and disabling password authentication in favor of SSH keys are crucial steps in protecting against such attacks.

---
Source: [Ars Technica](https://arstechnica.com/information-technology/2026/10/300-tor-exit-nodes-hijacked-to-intercept-ssh-traffic-and-retrieve-plaintext-email/)  
Published by Noti Group: https://noti.group/tor-exit-nodes-hijacked-by-hackers/