# Attackers hijacked 333 Tor relays to intercept SSH and email traffic

- URL: https://talkfuse.com/story/333-tor-exit-nodes-hijacked-to-intercept-ssh-traffic-and-retrieve-plaintext-email/
- Published: 2026-10-22T11:30:33+00:00
- Updated: 2026-10-22T12:17:59+00:00
- Original publisher: Ars Technica
- Original article: https://arstechnica.com/information-technology/2026/10/300-tor-exit-nodes-hijacked-to-intercept-ssh-traffic-and-retrieve-plaintext-email/
- Topics: Cybersecurity, Technology

## Key points

- 333 Tor exit relays were involved in the campaign.
- SSH connections were redirected to 12 attacker-controlled servers.
- Investigators do not know how all affected servers were accessed.

## Summary

Attackers hijacked 333 Tor exit relays for three days, redirecting SSH connections and attempting to expose email traffic. The campaign matters because Tor users who ignored a changed SSH host key warning could have handed over passwords, command histories and access to their servers.

The hijacking ran from 2 to 5 October. Investigators traced an initial breach to a reused password for a Tor management server and found the Linux backdoor Ebury on it and another server; they have not established how the attackers gained control of all the affected machines. Twelve attacker-controlled servers intercepted SSH connections, while compromised relays blocked several ports used for encrypted email but allowed unencrypted email traffic; it is unclear whether email connections were successfully downgraded.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.