For three days this month, from October 2 to October 5, roughly one in eight Tor exit relays sat under attacker control. The count is 333 relays, against a network that one tally of Tor Metrics data put at about 2,500 exit relays as of July 2025 — so 13% of exit capacity, if both numbers are right. The hijacked relays ran two interception schemes at once, Dan Goodin reported at Ars Technica, drawing on a Tuesday postmortem by Tor volunteers. How the attackers came to control most of those 333 servers is still not established.
The first scheme went after SSH. An exit relay is the server where a Tor circuit leaves the network, so it sees the destination of every connection it carries. The attackers reconfigured the relays to send any connection bound for port 22 — the standard SSH port — to one of 12 interceptor servers they ran. A user who noticed nothing then hit the one tripwire SSH has: the host key the interceptor presented did not match the real server’s key, and the client warned that it had changed. Users who dismissed that warning typed their real SSH password into a machine the attackers owned. The report does not say how many did.
The second scheme went after email. The same relays blocked ports 25, 465, 587, 993 and 995 — the ports behind most encrypted email sending and retrieval — while leaving the cleartext email ports open. The attack only pays off if the email service on the other end, or the client, silently falls back to an unencrypted connection when the encrypted one fails; that downgrade behaviour is exactly what protocols like STARTTLS have spent a decade trying to kill. The volunteers wrote that it is unclear whether any downgrade attempts succeeded, which suggests they could observe the port blocking but not the mail servers’ behaviour.
The flow, as reconstructed: Tor user | encrypted circuit (3 hops) v hijacked exit relay ── traffic on port 22 ──> one of 12 | interceptor servers | (password captured | all other traffic if host-key warning v ignored) real destination + ports 25/465/587/993/995: blocked + cleartext email ports: allowed
The way in
The incident began over a month before the exit relays were turned, in late August. According to the Tor volunteers, the attacker logged into a Tor management server with a valid password that had been reused — the oldest entry method there is — and installed Ebury, a Linux backdoor family first discovered 12 years ago. Ebury steals SSH credentials as users log in, which makes its presence on a shared management server worth more than the server itself: every admin password or key that touches the box feeds the next lateral move.
One lateral move followed and it is the strangest detail in the report. The attacker SSH’d from the management server into a second Tor server, known as Switzerland2, using an RSA key that investigators could not find in Switzerland2’s authorized keys. That should not authenticate. Either the key was authorized through some path the investigators have not identified, or it was authorized and then removed, or something about how the server accepted keys is still misunderstood. The volunteers flagged it as unexplained rather than resolved. With Switzerland2 in hand, the attacker installed Ebury there too and reconfigured the two exit relays it hosted.
What is still unexplained
Two exit relays came from the Switzerland2 compromise. The campaign ultimately involved 333. The gap between 2 and 333 is the number that matters and it is the one the report cannot close: investigators have not established how the attacker gained control of the other servers. Possibilities the record is consistent with include Ebury-harvested credentials being reused across volunteer-run infrastructure, but the volunteers did not commit to a mechanism.
If you happen to get a circuit that exits over one of those 333 infected exit nodes, you won’t notice anything at first. Encrypted web traffic is forwarded as usual, but if you attempt an SSH connection over Port 22, you’re unknowingly redirected to one of 12 SSH interception servers. That’s exactly what happened to me on Friday morning.
That was Kaba, the Tor volunteer who wrote Tuesday’s report, describing how the campaign was found: one redirection, one host-key warning, taken seriously instead of clicked through. Tor volunteers had already partially disclosed the management-server and Switzerland2 compromise and the email interception; Tuesday’s account added the scale — 333 relays — and the SSH redirection to 12 interceptor servers. The open quantities now are the ones the volunteers could not measure from the relay side: how many users ignored the host-key warning during those three days, whether any email downgrade attempts succeeded, and how 331 servers beyond the first two came to be running someone else’s configuration.